ISO 27001 Asset Management: The Annex A Controls (A.5.9 to A.5.13 and A.7.10)

ISO 27001 asset management is the set of processes for identifying an organization’s assets and applying security measures to protect them.

It sounds simple, but in practice, it is easy to miss things: confidential information often sits scattered across drives, SaaS tools, and cloud accounts that no one has inventoried.

This guide covers what ISO 27001 asset management requires under the 2022 controls (A.5.9 to A.5.13 and A.7.10), how to classify and handle assets, and how to build an inventory that holds up in an audit.

We also have a customizable asset management template for you at the end! Let’s get started.

What are assets according to ISO 27001?

An ‘asset,’ according to the ISO/IEC 27001, is anything that has value for the organization. Often, when organizations think of making an inventory of assets, they think of tangible assets such as hardware, infrastructure, and human resources, and miss out on intangible assets such as human intellect, intellectual property, and brand.

An asset in an organization can be:

• Information
• Intangible assets – Brand, IP, loyalty
• People – Employees, contractors, freelancers, volunteers, interns
• Hardware- IT Servers, laptops, desktops, cloud servers, POS devices, mobile devices, and more.
• Software- SaaS accounts, access to internal software,
• Services – Email, access to the internal database 
• Offices – Physical access to the office building, Off-site Processing Units, Warehouses, Server farms

What is ISO 27001 asset management?

ISO 27001 asset management is the practice of identifying an organization’s information assets, assessing the risks to them, and applying controls to protect them. In ISO 27001:2022 it maps to six Annex A controls that locate every asset, assign an owner, and set the security practices for each type. These tie back to your risk process under Clause 6.1.2, which surfaces the asset risks the controls treat.

The six controls that cover asset management

Asset management spans five organizational controls and one physical control:

• A.5.9 Inventory of information and other associated assets
• A.5.10 Acceptable use of information and other associated assets
• A.5.11 Return of assets
• A.5.12 Classification of information
• A.5.13 Labelling of information
• A.7.10 Storage media

What an asset management policy includes

The asset management policy documents how you meet those controls. A complete policy defines:

• how you build and maintain the asset inventory
• who owns each asset
• how access is granted and controlled
• how assets are returned when people leave
• how assets are securely disposed of, across the full lifecycle from procurement to disposal

Getting it right is a crucial step toward certification and a well-run ISMS.

What does ISO 27001 asset management require?

In ISO 27001:2022, the asset management controls (A.5.9 to A.5.13 and A.7.10) define how you identify, own, classify, use, return, and dispose of assets to become ISO 27001 certified.

Let us take a deeper look at the requirements of this Annex:

A.5.9 Inventory of information and other associated assets

An inventory of an organization’s assets is essential to build an effective ISMS.

During an ISO 27001 audit, the lead auditor reviews asset inventory and management to determine the performance of an ISMS.
We’ve included a detailed section further along the article on how to build an Inventory of assets.

Ownership of assets (part of A.5.9)

Every asset that gets created within an organization must have an asset owner. The asset owner’s responsibility is to manage the asset in its lifecycle effectively. Asset ownership can range from an individual to an entire department of an organization.

If any asset owner (asset manager) is changed, it is best practice to document those changes.

A.5.10 Acceptable use of information and other associated assets

Acceptable use of assets is commonly known as the” Acceptable Use Policy”. In your Acceptable Use Policy, ensure that you include not just your employees but also your freelancers, contractors, interns, volunteers, and other employment types (if any), and define the appropriate use of each information asset depending on their level of access to said assets. 

A.5.11 Return of assets

Employees must return their hardware to the organization whenever they leave an organization, and their access to internal systems and third-party software must be revoked. In addition, the returned hardware and revoked access to the software must be documented and stored.

Any failed hardware-return instance should be flagged as a security incident, and measures to resolve that incident should be applied.  

Having a functioning ISO 27001 Asset Management policy is important for a strong ISMS. Organizations can use tools to ensure that all the assets an employee has access to get returned/revoked successfully.

A.5.12 Classification of information

The objective of Annex A.8.2.1 is to help organizations classify information based on sensitivity, business value, legal requirements, and the impact of unauthorized access or disclosure.

A simple classification model may include:

Classification level	What it means	Examples
Public	Approved for external sharing	Website content, brochures, public policies
Internal	Meant for employees or approved stakeholders	SOPs, internal documentation, team reports
Confidential	Sensitive business information that needs restricted access	Customer contracts, financial data, employee records
Restricted	Highly sensitive information requiring strict controls	Credentials, encryption keys, regulated data, incident records

Organizations can define their own classification levels, but the model should be easy to apply. If the classification system is too simple, sensitive assets may not receive enough protection. If it is too complex, employees may ignore it or apply labels inconsistently.

The classification should determine how information is stored, accessed, shared, retained, and disposed of. For example, public website content may need limited controls, while customer data, credentials, or intellectual property should have defined ownership, restricted access, monitoring, and secure disposal rules.

A.5.13 Labelling of information

Labelling applies the classification model in day-to-day work. Once information is classified, employees need a clear way to identify how it should be handled.

A labelling process should define:

• the labels used for each classification level
• where labels should appear on documents, systems, repositories, or physical media
• which assets do not need labels
• how labelled information can be shared internally and externally
• who can change or remove a label
• how employees should handle incorrectly labelled information

The labelling process should be practical. If employees need too many steps to label or share information, adoption will drop. The goal is to make secure handling visible and repeatable without slowing down normal work.

Handling of assets (covered under A.5.10)

Asset handling defines how each class of information or asset should be used, stored, transferred, and protected.

Handling rules should be based on the asset’s classification. For example, confidential customer information may require restricted access, encryption, approved storage locations, and monitored transfers. Public information may only need basic version control and publishing approval.

Your asset handling process should cover:

• access restrictions based on classification
• approved storage locations
• rules for sharing information internally and externally
• encryption requirements for sensitive data
• logging of unauthorized access attempts
• secure handling of customer data
• requirements for physical and digital storage
• procedures for reporting misuse, loss, or unauthorized access

If your organization processes customer data, maintain a data flow map that shows where the data is collected, stored, processed, transferred, and deleted. This gives auditors a clearer view of how sensitive information moves through the business and how it is protected.

Alan Luk, who built GRC programs at Microsoft Azure and Grammarly, argues that unresolved ownership is the single root cause of most audit failures, and the fix has nothing to do with tooling.

“The first thing I did was identify ownership: who owns these controls, where does GRC’s responsibility begin, and where does the control owner’s responsibility start? A lot of companies do their monitoring by poking and checking right before the audit and hoping nothing is too bad — that’s typical of an immature programme. But it all starts with who owns these things. Get that right first, then you can build the processes and continuous monitoring on top.”

— Alan Luk, Head of Compliance, Grammarly

A.7.10 Storage media

In ISO 27001:2013, removable media, media disposal, and physical media transfer were three separate controls (A.8.3.1 to A.8.3.3). ISO 27001:2022 merges them into one control, A.7.10 Storage media, covering the full life of any storage media you use. Secure disposal of equipment also relates to A.7.14.

Removable media

Removable media includes USB drives, external hard disks, memory cards, and backup drives. Because they can be lost, copied, or used outside managed systems, define when removable media is allowed and who can use it, limit access to the roles that need it, and encrypt any sensitive data stored on them. Your policy should cover approved and prohibited media types, approval and access rules, encryption, storage and transport, logging, and how to report lost or stolen media. When media is no longer needed, make the data unrecoverable through secure deletion, overwriting, or physical destruction.

Disposal

When media is retired, reused, or destroyed, make sure no sensitive information leaves with it. Before disposal, check whether the media holds confidential data, regulated data, credentials, or licensed software, and securely remove or destroy it if so. Methods include wiping or overwriting, encryption followed by key destruction, physical destruction, or certified disposal through an approved vendor. Keep disposal records, wiping logs, destruction certificates, vendor confirmations, and approvals as your audit evidence.

Transfer

When storage media or equipment moves between locations, protect it in transit. Use a reliable courier or approved transport method, package it to prevent damage, encrypt sensitive data before transfer, and keep a record of what was sent, when, and who received it. Verify the contents and check for tampering on arrival, and require the receiving party to acknowledge receipt. For sensitive or regulated information, approve and log transfers in advance.

Why is asset management ISO 27001 important for security management?

Asset Management directly influences information security. However, this influence could be negative when businesses don’t focus on implementing a robust asset management strategy. Here’s how:

When organizations perform ISO 27001 risk assessments, they usually examine their assets to identify risks, the risk each asset is exposed to, identify existing vulnerabilities and look for areas for improvement to include in their risk treatment plan.

If you do not know what assets you have, you cannot protect them, and unmanaged assets are where gaps and incidents tend to start. A complete, current inventory is what lets your risk assessment and incident response actually work.

How to build an asset inventory

An asset inventory is the foundation of ISO 27001 asset management. It helps the organization identify what assets exist, who owns them, where they are stored, how they are used, and which controls apply to them.

“73% of auditors report spending over half their time inside spreadsheets — managing reconciliations, pulling data, and navigating outdated, manual workflows.“

— Audit Momentum Mastery: Agile and Efficient Audits for Hyper-Growth Organizations

Start with the asset list created during your risk assessment, then validate it with each business function. Ask teams to document the hardware, software, cloud systems, data stores, physical assets, third-party tools, and information assets they use.

A useful asset inventory should include:

• asset name and description
• asset type, such as hardware, software, information, people, services, or cloud resources
• asset owner
• department or business function
• location or system of record
• classification level
• access permissions
• related suppliers or dependencies
• associated risks
• lifecycle status, such as active, retired, transferred, or disposed
• review date and next review owner

The inventory should be reviewed periodically and updated whenever assets are added, transferred, retired, or disposed of. Aligning the asset inventory review with the risk assessment cycle is a good practice because it keeps asset ownership, classification, and risk treatment current.

Who should be the asset owner?

Every asset in an organization should have a designated asset owner. And the owner of a certain asset should manage it daily.

For example

For shared assets like cloud services, the overall ownership of the service should belong to the CTO (Chief Technology Officer) or the CISO (Chief Information Security Officer), while for files created and used by employees within the cloud account, the file’s creator should be the owner. 

It is the responsibility of asset owners to ensure that their assets are:

• Accounted for (inventoried)
• Classified(an appropriate level of security is provided based on classification)
• Subject to controls and security measures, 
• Destroyed safely and securely

Automate asset management with Sprinto

The hardest part of asset management is not the policy, it is knowing what you actually have.

A single forgotten asset, like a public S3 bucket no one remembers creating, can undo the rest of your controls.

Sprinto connects to your cloud, identity, and SaaS systems across 300+ integrations and discovers those assets for you, so nothing sits outside your inventory.

From there, it keeps the register current: it assigns owners, maps each asset to its Annex A control, flags misconfigurations and drift as they happen, and collects the evidence your auditor needs. Asset management stops being a spreadsheet you chase and becomes something that maintains itself.