ISO 27001 Asset Register: What to List and Why
An ISO 27001 asset register is an inventory of the information your organisation depends on and the systems, services and devices that hold it, with a named owner and a classification against each entry. ISO/IEC 27001:2022 asks for it through Annex A control 5.9. A workable register for a small Australian business usually runs to between 30 and 80 entries, not thousands, and every entry has one person accountable for it.
The hardest part is not building the register. It is deciding what belongs in it, because a register that lists everything stops being maintained within a month of certification.
What does ISO 27001 actually require in an asset register?
ISO/IEC 27001:2022 requires an inventory of information and other associated assets through Annex A control 5.9. The control asks you to develop and maintain that inventory, including ownership.
Three things follow from the wording of Annex A 5.9, and they are what an auditor tests:
- Information comes first. The control is about information and the assets associated with it, not an IT hardware list. A laptop matters because of what it reaches.
- Ownership is explicit. Every asset needs an owner, and the owner is a named role accountable for the asset, not the IT team by default.
- It has to be maintained. An inventory accurate on the day of the audit and stale three months later does not satisfy the control.
The asset register is not on the short list of documents ISO 27001 names as mandatory records in the management clauses, but in practice no certification body will pass an information security management system without one, because risk assessment and the Statement of Applicability both depend on knowing what you hold. The documents that are strictly required are set out in ISO 27001 documentation: what is actually mandatory.
What should an ISO 27001 asset register include, and what should it leave out?
An ISO 27001 asset register should include the information the business would suffer without, the systems and services that hold that information, and the devices that store or access it. It should leave out individual files, office furniture, and anything outside the declared scope of the information security management system.
Include these categories:
- Information assets. Customer records, employee and payroll records, financial records, source code, contracts, intellectual property.
- Software and services. The SaaS platforms and applications that process the information above, including your identity provider, your email tenant and your code repository.
- Infrastructure. Servers, cloud accounts, databases, network equipment and backup locations.
- Endpoints. Laptops, mobile devices and any removable media still in use, usually grouped by type rather than listed one by one.
- Supporting assets. Physical premises and, where relevant, key people whose knowledge the organisation depends on.
Leave out individual documents, every monitor and keyboard, personal devices with no access to company information, and any system that sits outside the boundary you defined. If you are unsure where that boundary falls, defining your ISMS scope comes before building the register, not after.
What does a usable asset register row look like?
A usable asset register row names the asset, says what type it is, names an owner, carries a classification and records where the asset lives. Five or six columns is enough for most Australian small and medium businesses.
| Column | What goes in it | Why an auditor cares |
|---|---|---|
| Asset | A specific, recognisable name | Vague entries cannot be risk assessed |
| Type | Information, software, service, hardware, premises | Shows the register covers more than IT equipment |
| Owner | A named role, such as Finance Manager | Accountability for decisions about the asset |
| Classification | Public, internal, confidential, restricted | Drives the handling rules applied to it |
| Location | System, provider and data region | Supports data sovereignty and supplier questions |
| Review date | When it was last confirmed accurate | Demonstrates the register is maintained |
Some organisations add a criticality or value rating. That is useful if it feeds your risk assessment, and clutter if it does not. Add a column only when something downstream consumes it.
Who should own each asset in the register?
The owner of an asset is the person accountable for decisions about it: who may access it, how it is classified, and whether a risk to it is accepted or treated. That is a business role, not the IT team by default.
Ownership usually falls out naturally once you ask who would make the call if access had to be revoked. Payroll records belong to the person running payroll. The customer database belongs to the person accountable for the product or the service that holds it. The Microsoft 365 tenant belongs to whoever decides who gets an account.
Two patterns cause audit findings. The first is assigning every asset to the IT manager, which tells an auditor nobody in the business has engaged with the exercise. The second is naming individuals rather than roles, so the register breaks the day someone leaves. Name the role and keep a separate list of who holds it.
How do you classify assets without overcomplicating it?
Classify assets with the smallest number of levels your organisation will actually apply. Most Australian small and medium businesses need three or four: public, internal, confidential, and sometimes restricted for a narrow set of information such as payroll or health data.
A classification scheme earns its place only if each level comes with different handling rules. If confidential and restricted information are stored, shared and disposed of identically, you have two labels and one control, and an auditor will ask about the difference. Write the handling rules first, then set the number of levels to match.
Classification also connects the register to the rest of the system. The classification of an asset should be visible in your risk assessment, and the controls you selected to protect it should be traceable to your Statement of Applicability. When those three documents disagree, the asset register is usually the one that was not updated.
How often should the asset register be reviewed?
Review the ISO 27001 asset register at least annually, and update it whenever something material changes rather than waiting for the annual review.
Events that should trigger an update:
- Adopting a new SaaS platform or cloud service that holds company or customer information
- Retiring a system, including confirming where the data went and whether it was destroyed
- A change of asset owner, such as a role being filled by someone new or a function being restructured
- A change in scope of the information security management system
- A new category of information entering the business, for example when a new product line starts collecting different personal information
A practical approach that survives contact with a small team: review the register at each management review, and make updating it part of the checklist for onboarding any new system. The internal audit is where an inaccurate register tends to surface, which is a far better place to find it than a certification audit.
Where do most asset registers go wrong?
Most ISO 27001 asset registers fail for one of four reasons, and all four are visible to an auditor within a few minutes.
- It is a hardware list. Every laptop and switch, no information assets. The control is about information first.
- It is too granular. Four thousand rows generated from an asset management tool, which nobody has reviewed and nobody can risk assess.
- Ownership is nominal. Every row says IT, and the named owners cannot describe their assets when the auditor asks.
- It is disconnected. Assets appear in the register that are absent from the risk assessment, and risks reference systems that never made it into the register.
The test to apply before an audit is simple. Pick three rows at random, and check that the named owner knows they own it, that the classification matches how the information is actually handled, and that the asset appears in your risk assessment. If all three hold for three random rows, the register is in reasonable shape.
Common questions
What is an information asset under ISO 27001?
An information asset is any information that has value to the organisation, together with the things that hold or process it. That includes customer records, financial data, source code, contracts and employee information, as well as the databases, applications and cloud services where that information lives. The practical test is whether losing it, having it altered without authorisation, or having it exposed would cause the business harm.
What is the ISO 27001 definition of an asset?
ISO/IEC 27001:2022 frames assets as information and other associated assets, which widens the idea beyond equipment. In Annex A 5.9 the requirement is an inventory of information and other associated assets, including ownership. So an asset is anything in scope that holds value for the organisation because of the information attached to it, whether that is a database, a SaaS platform, a laptop or a paper file.
Who is the asset owner under ISO 27001?
The asset owner is the role accountable for an asset throughout its life: approving who has access, setting its classification, and deciding how risks to it are treated. The owner does not have to operate the asset day to day. A Finance Manager can own payroll records while the IT team administers the system that holds them.
Does ISO 27001 require an asset classification scheme?
Annex A includes classification of information as a control, so if it applies to your organisation you need a scheme and it needs to be used consistently. Most businesses apply three or four levels. What matters to an auditor is that each level carries different handling rules and that the classification recorded in the register matches how people actually treat the information.
Can you use a spreadsheet for an ISO 27001 asset register?
Yes. A spreadsheet is acceptable to every certification body and is what most Australian small and medium businesses use. The control asks for an inventory that is maintained with ownership recorded, and says nothing about the tool. The risk with a spreadsheet is version drift when several people edit copies, so keep one authoritative file with controlled access and a visible review date.
Building a register that survives the audit
Start with the information, not the equipment. List what the business would suffer without, work outwards to the systems that hold it, name an owner for each, and stop when adding another row stops telling you anything new. A register you can keep current for three years is worth more than a complete one you abandon after certification.
Siege Cyber helps Australian organisations build information security management systems that pass certification and stay workable afterwards. See the ISO 27001 service for how we work, or get in touch to talk through where your register stands. For a sense of what a structured register looks like in practice, the Office of the Victorian Information Commissioner publishes a sample information asset register template aimed at Victorian public sector organisations.