ISO 27001 A.5.9: asset inventory, explained for startups

A.5.9 Inventory of information and other associated assets

You know what devices, accounts, data and software you have, and who owns each. What proves it: an inventory of devices, cloud accounts, data stores and key software, with an owner for each.

A certification auditor samples the asset inventory with owners and a review date. A file that usually does the job: a device management export and a cloud account list in one spreadsheet with an owner column.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.9 walks you through it in this order.

1. Export devices from your device management tool and accounts from your cloud provider.
2. Add the software services and data stores that hold customer data.
3. Give each item an owner and review the list at least once a year.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do you keep an inventory of devices, cloud accounts, data stores and software, with an owner for each?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Asset Management and Information Classification Policy covers A.5.9. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC6.1, logical access.

Organizational controls

A.5.9 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.6, security communities
• A.5.7, threat intelligence
• A.5.8, security in projects
• A.5.10, acceptable use
• A.5.11, returning assets
• A.5.12, classifying information

Before it: A.5.8, security in projects. After it: A.5.10, acceptable use. Every control, by theme, is on the Annex A controls page.