Content library
ISO 27001 (2013): Full
8.1.1: Inventory of assets

How to fill the requirement

ISO 27001 (2013): Full

8.1.1: Inventory of assets

Task name
Priority
Status
Theme
Policy
Other requirements
Data system listing and owner assignment
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Data system management
43
requirements

Task is fulfilling also these other security requirements

I06: Pääsyoikeuksien hallinnointi
Katakri
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
TiHL
24. Responsibility of the controller
GDPR
5. Principles relating to processing of personal data
GDPR
32. Security of processing
GDPR
1. Task description

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

  • System purpose and linked responsibilities
  • System's data location (covered in a separate task)
  • System's maintenance and development responsibilities and linked partners (covered in a separate task)
  • When necessary system's access roles and authentication methods (covered in a separate task)
  • When necessary systems interfaces to other systems (covered in a separate task)
Documentation of data sets for data stores
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Management of data sets
38
requirements

Task is fulfilling also these other security requirements

T07: Tietojen luokittelu
Katakri
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
TiHL
15 §: Tietoaineistojen turvallisuuden varmistaminen
TiHL
6. Lawfulness of processing
GDPR
5. Principles relating to processing of personal data
GDPR
1. Task description

The organization shall maintain a list of data sets contained in the data stores it manages.

The documentation shall include at least the following information:

  • Data systems and other means used to process the data sets
  • Key categories of data in the data set (and whether it contains personal data)
  • Data retention period (discussed in more detail in a separate task)
  • Information on archiving / disposal of data (discussed in more detail in a separate task)
Data processing partner listing and owner assignment
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Partner management
Agreements and monitoring
34
requirements

Task is fulfilling also these other security requirements

28. Data processor
GDPR
44. General principle for transfers
GDPR
26. Joint controllers
GDPR
15.1.1: Information security policy for supplier relationships
ISO27 Full
8.1.1: Inventory of assets
ISO27 Full
1. Task description

The organization must maintain a list of partners who have access to confidential information. System vendors and processors of personal data are listed separately from other stakeholders because they play an active role in the processing of data.

Data store listing and owner assignment
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Privacy
Processing principles and accountability
36
requirements

Task is fulfilling also these other security requirements

5 §: Tiedonhallintamalli ja muutosvaikutuksen arviointi
TiHL
6. Lawfulness of processing
GDPR
5. Principles relating to processing of personal data
GDPR
8.1.1: Inventory of assets
ISO27 Full
6.7: Asiakas- ja potilastietojärjestelmät, niihin liitetyt tietojärjestelmät ja muut tietojärjestelmät
Self-monitoring
1. Task description

Organisation must maintain a listing of controlled data stores and their owners. Owner is responsible for completing the documentation and other possible security actions directly related to the data store.

Data store documentation must include at least:

  • Connected responsibilities
  • Data processing purposes (covered in a separate task)
  • Data sets included in the data store (covered in a separate task)
  • Data disclosures (covered in a separate task)
  • When necessary, data stores connections to action processes
Documentation of other protected assets
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Physical security
Equipment maintenance and safety
23
requirements

Task is fulfilling also these other security requirements

8.1.1: Inventory of assets
ISO27 Full
8.1.2: Ownership of assets
ISO27 Full
ID.AM-1: Physical device inventory
NIST
ID.AM-2: Software and app inventory
NIST
HAL-04: Suojattavat kohteet
Julkri
1. Task description

The organization shall list all relevant protected assets to determine ownership and to ensure that security measures cover all necessary items.

A large portion of the protected assets (including data sets, data systems, personnel / units, and partners) are treated through other tasks. In addition, the organization must list other important assets, which may be, depending on the nature of its operations, e.g. hardware (servers, network equipment, workstations, printers) or infrastructure (real estate, power generation, air conditioning). In addition the organization should make sure that relevant external devices are documented.

Documentation of assets inventories outside the ISMS
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Management of data sets
16
requirements

Task is fulfilling also these other security requirements

8.1.1: Inventory of assets
ISO27 Full
ID.AM-1: Physical device inventory
NIST
ID.AM-2: Software and app inventory
NIST
HAL-04: Suojattavat kohteet
Julkri
HAL-04.1: Suojattavat kohteet - vastuut
Julkri
1. Task description

Assets to be protected related to information and data processing services should be inventoried. The purpose is to ensure that the cyber security is focused on the necessary information assets.

Inventory can be done directly in the management system, but an organization may have other, well-functioning inventory locations for certain assets (including code repositories, databases, network devices, mobile devices, workstations, servers, or other physical assets).

Describe in this task, which lists outside the management system are related to protection of information assets.

Documentation of interfaces for data systems
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Data system management
17
requirements

Task is fulfilling also these other security requirements

24 §: Tietoaineistojen luovuttaminen teknisen rajapinnan avulla muille kuin viranomaisille
TiHL
22 §: Tietojen luovuttaminen teknisen rajapinnan avulla viranomaisten välillä
TiHL
23 §: Katseluyhteyden avaaminen viranomaiselle
TiHL
8.1.1: Inventory of assets
ISO27 Full
DE.AE-1: Baseline of network operations
NIST
1. Task description

The organization maintains documentation of interfaces and other connections between data system and the data transmission methods used in the interfaces.

The documentation concerning the interfaces shall be reviewed regularly and after significant changes to data systems.

Documentation of personal data outside data systems
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Management of data sets
7
requirements

Task is fulfilling also these other security requirements

5. Principles relating to processing of personal data
GDPR
8.1.1: Inventory of assets
ISO27 Full
5.9: Inventory of information and other associated assets
ISO27k1 Full
63: Rakenteettoman tiedon tunnistaminen ja hallinta
Sec overview
CC6.1a: Identification and listing of assets
SOC 2
1. Task description

Registrants have the same rights to their personal data, no matter in what form we store them. We need to be able to communicate processing and provide data subjects with access to personal data, whether on paper, in local files or in data systems.

We separately document personal data that is stored outside of data systems.

Device list maintenance in a mobile device management system
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Remote work and mobile devices
Mobile device management
4
requirements

Task is fulfilling also these other security requirements

8.1.1: Inventory of assets
ISO27 Full
1.2.1: Establish a process to identify devices and software in use at the organisation
NSM ICT-SP
1.2.3: Identify devices in use at the organisation
NSM ICT-SP
1. Task description

The devices must be registered in the mobile device management system in order to obtain a unique identifier for the device and to use the management features. When purchasing new devices, the devices are always registered in the mobile device management system.

No items found.