The policy is the evidence

Purpose

You cannot protect what you cannot see. Access reviews, vulnerability management, change control and incident response all begin by asking which systems exist and who is responsible for them, and every one of them is only as complete as the answer.

This policy sets out how the organization identifies its information assets, records them, assigns ownership of them, and manages them from acquisition through to disposal.

Scope

Applies to all employees, contractors and third parties who acquire, operate, hold or dispose of an asset on behalf of the organization. It covers end-user devices, servers, containers, databases, and the accounts, domains and cryptographic keys that make them reachable.

Roles and responsibilities

The policy owner owns the asset register as a whole and is accountable for its completeness. Asset owners are accountable for the individual assets recorded against their name.

The asset register

Every asset is recorded in a single register, whether a connector discovered it or a person entered it by hand. A record carries the asset’s name, its kind, its owner, its classification and its lifecycle state, and no record is complete without all five.

Classification

Every asset is classified when it is recorded and reclassified when what it holds changes. The classification decides what protection it gets, so an unclassified asset is treated as the most sensitive one it could be until somebody says otherwise.

Disposal

An asset leaves the register only once whatever it held has been destroyed or returned, and the record of its disposal outlives the asset itself.