What Is the Asset Management Policy in ISO 27001?

The ISO 27001 policy for asset management is straightforward: Assets are a critical component of an organization’s security posture, meaning a company must monitor and control access to assets. The policy covers all physical and electronic assets, including information and related data.

Owning assets comes with responsibilities, and organizations must define and document the roles of ownership. A written policy with an updated inventory ensures the accounting of all assets and helps to prevent unauthorized access. The policy should outline all historical and current information about individual assets, including changes in asset ownership.

The A.8 asset management policy applies to all businesses regardless of industry or size. Every company pursuing ISO 27001 certification should follow several steps to implement and show control over assets:

• Account for all assets
• Develop processes for tracking and approving asset changes
• Define asset ownership roles and responsibilities
• Implement security measures to restrict and eliminate unauthorized access

What Should You Include in an ISO 27001 Asset Management Inventory?

The asset management policy in ISO 27001 focuses on classifying assets and information, helping organizations protect assets by determining the required security levels. To determine the type and labeling of assets, companies must first identify them and create an inventory.

ISO 27001 primarily focuses on assets that may influence the accessibility of information, which include human assets, financial assets, information assets, and intangible assets. Some examples of items to have on an inventory list:

• Client Databases
• Licensures
• Trademarks
• Certifications
• Passwords

The primary aim of the inventory in the asset management policy in ISO 27001 is to list all information assets or items that have value for the organization. As a company compiles a list, it should consider software, websites, employee files, and servers.

Information Classification

An inventory helps organizations evaluate their assets and provide a valuation, which helps determine the level of security an asset requires. The logic of the evaluation and classification process is that assets should have a level of security commensurate with their value to an organization. Organizations determine value by assessing the sensitivity and potential effect of asset disclosure.

When assessing assets, an organization uses three defined levels of security: public, internal, and restricted. Public assets require the least amount of security controls because they are open and available to the public. Internal assets require a certain level of control because the data is only accessible to employees and the internal organization. Restricted assets require the highest level of security controls because they are highly sensitive. Examples of restricted assets include customer information, employee files, and intellectual property.

What Does the Asset Management Policy in ISO 27001 Say About Asset Handling?

Annex A.8 has a lot to say about asset handling, and it starts with proper labeling, which is assigning labels that indicate an asset’s level of sensitivity and its security needs. Sensitivity labels are the organization’s responsibility and are based on earlier impact assessments. There are three types of labels:

1. Classification labels: These labels address the sensitivity of the information and necessary security controls.
2. Handling labels: These labels identify or list specific handling instructions, such as the need for encryption or a requirement to destroy the asset after a set period.
3. Proprietary labels: These labels help protect assets from unauthorized disclosure.

To comply with the asset management policy in ISO 27001, organizations should create and adopt policies and procedures for labeling information. The policy must specify the labels, sensitivity protocols, security controls, and the process for applying labels. Only after creating an inventory and establishing a labeling policy can companies hope to handle information assets correctly and securely.

Handling of Assets

ISO 27001, Annex A.8.2.3, discusses the handling of assets explicitly. It states that organizational procedures must ensure confidentiality, integrity, and availability of all information and communication technology assets. The ISO standard suggests several controls organizations can implement:

• Physical and environmental security
• Secure locations and storage
• Safe disposal or reuse of assets
• Monitoring of assets
• Information security classifications

To determine the proper controls, organizations must assess individual circumstances and needs. An organization also must agree on the requirements for handling assets before putting controls in place. Also, in creating a handling asset procedure, the organization must put steps in place to ensure all asset changes receive proper authorization, review, and approval before implementation.

The handling procedure should include security measures and steps for the transfer, removal, or destruction of the asset. By ensuring the policy covers every aspect of the asset lifecycle, the organization can maintain security throughout.