ISO 27001 asset register: what to include and how to keep it current

Your asset register (or asset inventory) lists the things your ISMS protects: the information itself and the systems, devices and services that hold or process it. You can't protect what you don't know you have, so the register is the foundation for your risk assessment and many of your controls.

Why it matters

The asset register serves Annex A control 5.9 (inventory of information and other associated assets) in ISO/IEC 27001:2022, with related controls:

• 5.9: keep an inventory of information and other associated assets, with owners.
• 5.10: define acceptable use of information and assets.
• 5.11: get assets back when people leave or contracts end.
• 5.12 and 5.13: classify information and label it according to that classification.

It also supports your risk assessment under clause 6.1.2: risks are about something, and the register says what.

What to include

Record assets at a level you can manage. A practical set for a small organisation:

• Information: customer data, staff records, financial records, source code, contracts.
• Software and services: your product, cloud platforms, email, file storage, finance and HR systems.
• Devices: laptops, phones, servers and network equipment.
• People-held knowledge, where it matters: the one person who knows how the billing system works is a risk worth recording.

For each, capture: a name, the type, an owner, where it's held, its classification (for example public, internal, confidential), and which suppliers are involved.

What an auditor looks for

• Every asset has an owner, a named person or role responsible for it.
• It matches your scope. What's in scope is in the register, including cloud services and home-working devices.
• It's used. Risks link to assets, and the classification drives handling rules.
• It's current. New laptops and new SaaS tools appear; leavers' devices are returned and recorded.

Common reasons it fails: a spreadsheet last updated at the start of the project; cloud services missing; no owners; or devices that can't be found when the auditor samples them.

Common mistakes, and how to keep it manageable

• Listing every cable and mouse. Group low-value items (for example "staff laptops, managed by device management") and track individual devices in the tool that already manages them.
• Forgetting the information. Systems are easy to list. The customer data inside them is what you're actually protecting.
• Duplicating records. Keep one register and link risks, suppliers and processing records to it, rather than copying asset details into each.
• No trigger for updates. Tie updates to joiners, leavers, purchases and new suppliers.

How to do it in ClearIMS

1. Start from the draft. The onboarding chat builds a first asset list from what you tell it about your business. Check it and fill the gaps.
2. Open Assets and give every asset an owner, a type, where it's held and a classification.
3. Link it up. Assets link to the risks, controls and evidence about them, so a change to an asset shows you what else to check.
4. Keep it current. Review the register when people join or leave, when you buy equipment and when you add a supplier.

Related pages

• Risk register: what could go wrong with each asset.
• Supplier register: who hosts or handles your assets.
• Software licences and Controlled media: specialised asset records.
• Access reviews: checking who can reach your key assets.