isms.coach
← All controls

A.5.9 · Organizational

Inventory of information and other associated assets

Why it matters

You can't protect what you don't know you have — this is the foundation the rest of the SoA builds on.

How a self-led small team implements it

A spreadsheet of systems, data stores, and who owns each is a legitimate asset inventory for a small business.

What auditors expect to see

Asset register with owners and classification.

Track A.5.9 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.

Start your ISMS

More organizational controls