Templates and records · ISO 27001 · Clause A.5.9
ISO 27001 information asset inventory template
The list of information and the systems that support it, each with its owner and classification, which gives meaning to the risk assessment and to access control.
In one sentence
The information asset inventory links information and its associated assets —applications, equipment, cloud services, key people— to their owner, their location and their classification; it is required by control 5.9 in Annex A of ISO/IEC 27001:2022, which calls for it to be developed and kept up to date.
- Where the standard requires it
- ISO 27001 · Clause A.5.9 Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.
- Type of information
- Mandatory document Annex A control 5.9: maintained if the statement of applicability includes it
- Who fills it in
- Asset owners IT consolidates it; each owner is accountable for their assets being listed and accurate
- When
- Whenever an asset is added, retired or changed With a full review at least before the annual risk assessment
- How long it is kept
- Always current It is kept up to date; it is worth keeping the history of additions and removals to reconstruct what existed on a given date
What the standard requires
What ISO 27001 demands and what it leaves to your judgement
The body of the standard does not require an inventory: control 5.9 does, asking for an inventory of information and other associated assets, with their owners. Since an organisation can rarely exclude it on solid grounds, in practice every auditor expects it.
ISO/IEC 27002 gives guidance on the level of detail: enough to manage the risks, not a list of every cable. What matters is that every relevant asset has an owner and that the inventory is kept current as items are added and retired.
The inventory is supported by other controls: classification (5.12), acceptable use (5.10) and the return of assets when people leave the company (5.11).
Structure
Fields the template should include
- Asset identifier and name
- Type: information, application, cloud service, equipment, media, key person
- Owner
- Location or hosting provider
- Information classification (for example, public, internal, confidential)
- Processes or services that depend on it
- Whether it contains personal data
- Date added, last reviewed and retired
Example
Example: four assets at a software company
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| A-001 Customer database | Information · Owner: sales director · Confidential · Personal data: yes |
| A-014 SaaS platform | Application · Owner: operations director · Hosted with a cloud provider, EU region |
| A-022 Code repository | Cloud service · Owner: chief technology officer · Confidential |
| A-040 Team laptops | 82 units · Owner: IT manager · Mandatory disk encryption |
| Last review | 28 August 2026, ahead of the annual risk assessment |
At the audit
Mistakes auditors commonly flag
- A hardware-only inventory: information and cloud services are missing.
- A generic owner (“IT department”) instead of a named person.
- Staff leavers with no record of equipment being returned.
- The classification in the inventory does not match the one applied to documents.
In Kimobox
How this record is kept in Kimobox
- 1The information asset inventory is built with an owner and a classification for each asset.
- 2The owner of each asset and each risk is assigned directly in the system, and the risk assessment is linked to the assets.
- 3The inventory is a versioned record: every addition, removal or change is stored with its date and author.
Frequently asked questions
What people ask us before getting started
What level of detail does the inventory need?
Enough to manage the risks. Grouping laptops of the same model and configuration on one line is reasonable; lumping all customer information onto a single line is not.
Does the same inventory work for the ENS?
Yes, with some nuances: measure op.exp.1 of the Spanish National Security Framework (ENS) also requires an up-to-date inventory with a named person responsible. It is worth adding which categorised system each asset belongs to.
Keep your ISO 27001 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Context of the organization
The information security system starts by knowing which assets need protecting and who holds expectations…
ISO 27001 statement of applicability template
What the ISO 27001 statement of applicability (6.1.3 d) must contain: necessary controls, justification…
ISO 27001 information security risk assessment template
How to document the information security risk assessment ISO 27001 requires: acceptance criteria, risk…
ISO 27001 risk treatment plan template
What the ISO 27001 risk treatment plan (6.1.3 e) must include: the option chosen, controls, owner, deadline…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
- ISO/IEC 27002:2022 — Information security controls ISO/IEC · February 2022