# Information Asset Inventory Template

## Purpose

This template helps you systematically identify, categorize, and track all information assets within your organization. An asset inventory is fundamental for risk assessment, compliance (E-ITS, ISO 27001, GDPR), and security management.

## When to Use

- Starting a new information security management system (ISMS)
- Conducting risk assessments
- Preparing for E-ITS, ISO 27001, or SOC 2 audits
- GDPR compliance (identifying data processing systems)
- Business continuity planning

## How to Use

1. **Identify Assets**: List all information assets (data, systems, hardware, software, services)
2. **Categorize**: Group by type (databases, applications, infrastructure, etc.)
3. **Assess Value**: Determine business criticality and sensitivity
4. **Assign Ownership**: Identify asset owners and custodians
5. **Document Dependencies**: Map relationships and dependencies
6. **Review Regularly**: Update quarterly or when significant changes occur

## Official References

- **E-ITS**: Infosüsteemi turvaklassist ja turvatoimingutest (§ 7)
- **ISO 27001:2022**: Annex A 5.9 Inventory of information and other associated assets
- **GDPR**: Article 30 - Records of processing activities (related)

---

## Asset Inventory Register

### Asset Information

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Asset ID** | Unique identifier | AS-2024-001 |
| **Asset Name** | Descriptive name | Customer Database |
| **Asset Type** | Category | Database / Application / Hardware / Service |
| **Description** | Brief description | PostgreSQL database containing customer records |
| **Location** | Physical/logical location | AWS eu-north-1 / Server Room A |

### Classification & Value

| **Field** | **Description** | **Values** |
|-----------|-----------------|------------|
| **Confidentiality** | Information sensitivity | Public / Internal / Confidential / Restricted |
| **Integrity** | Importance of accuracy | Low / Medium / High / Critical |
| **Availability** | Uptime requirements | 99% / 99.9% / 99.99% / 99.999% |
| **Business Criticality** | Impact if unavailable | Low / Medium / High / Critical |
| **Data Sensitivity** | Type of data stored | Personal Data / Financial / Health / Trade Secret |

### Ownership & Responsibility

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Asset Owner** | Business owner responsible | Head of Customer Service |
| **Technical Custodian** | IT/Security responsible | Database Administrator |
| **Department** | Owning organizational unit | Sales & Marketing |
| **Users/Stakeholders** | Who uses this asset | Sales team, Support team, Management |

### Technical Details

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Technology/Platform** | Underlying technology | PostgreSQL 15.4 |
| **Vendor/Provider** | Manufacturer or service provider | AWS RDS |
| **Version** | Software/hardware version | 15.4 |
| **License Type** | Licensing model | Open Source / Commercial / SaaS |
| **Support Status** | Vendor support status | Fully supported / EOL in 2027 |

### Dependencies & Relationships

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Depends On** | Assets this asset relies on | Network infrastructure, Authentication service |
| **Supports** | Assets that depend on this | CRM application, Reporting system |
| **Data Flows** | Inbound/outbound data connections | Receives from: Web App, Sends to: Analytics Platform |

### Security & Compliance

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Access Control** | Who has access | Role-based / Named individuals / Public |
| **Encryption** | Encryption status | TLS 1.3 in transit, AES-256 at rest |
| **Backup Status** | Backup configuration | Daily incremental, weekly full |
| **Compliance Requirements** | Applicable regulations | GDPR, E-ITS Level 3, ISO 27001 |
| **Last Security Review** | Date of last assessment | 2024-Q4 |

### Lifecycle Management

| **Field** | **Description** | **Example** |
|-----------|-----------------|-------------|
| **Acquisition Date** | When asset was acquired | 2023-01-15 |
| **Planned Retirement** | Expected end-of-life | 2027-12-31 |
| **Replacement Plan** | Migration/upgrade strategy | Migrate to managed PostgreSQL service |
| **Maintenance Schedule** | Regular maintenance | Patched monthly, reviewed quarterly |

### Change History

| **Date** | **Change Type** | **Description** | **Changed By** |
|----------|----------------|-----------------|----------------|
| 2024-01-15 | Initial Entry | Asset registered | J. Anderson |
| 2024-03-20 | Update | Upgraded to v15.4 | IT Team |
| 2024-06-10 | Classification | Increased to Confidential | Security Officer |

---

## Asset Categories (Examples)

### 1. Data Assets
- Customer databases
- Employee records
- Financial data
- Intellectual property
- Backups and archives

### 2. Software Assets
- Operating systems
- Business applications
- Development tools
- Security software
- Mobile applications

### 3. Hardware Assets
- Servers and workstations
- Network equipment
- Storage devices
- Mobile devices
- IoT/OT devices

### 4. Service Assets
- Cloud services (SaaS/PaaS/IaaS)
- Managed services
- Third-party APIs
- Telecom services

### 5. Documentation & Policies
- Security policies
- Procedures and guidelines
- Contracts and agreements
- Compliance documentation

---

## Risk-Based Prioritization

Use the Asset Value calculation to prioritize security efforts:

**Asset Value Score** = (Confidentiality × 3) + (Integrity × 2) + (Availability × 2) + (Business Criticality × 3)

| **Score Range** | **Priority** | **Action** |
|-----------------|--------------|------------|
| 30-40 | Critical | Maximum protection, continuous monitoring |
| 20-29 | High | Strong controls, regular audits |
| 10-19 | Medium | Standard controls, periodic review |
| 0-9 | Low | Basic controls, annual review |

---

## Compliance Mapping

### GDPR Article 30 Connection
If the asset processes personal data, reference your Data Processing Register (see separate template).

### E-ITS Requirements
Assets must be classified by security level (K1/K2/K3) and protected accordingly.

### ISO 27001 Annex A 5.9
This inventory directly fulfills the requirement for identifying assets and assigning ownership.

---

## Review & Maintenance

- **Frequency**: Review quarterly or after significant changes
- **Triggers**: New systems, acquisitions, decommissioning, security incidents
- **Responsibilities**: Asset owners review accuracy, Security team reviews classification
- **Approval**: CISO or designated authority approves changes

---

## Additional Notes

- Keep this inventory up-to-date - an outdated inventory creates security blind spots
- Integrate with change management processes
- Cross-reference with risk register and incident response plans
- Consider using automated discovery tools for large environments
- Ensure proper access controls to the inventory itself (it's sensitive!)

---

**Template Version**: 1.0
**Last Updated**: 2024-01-04
**Source**: InfoPol - Free InfoSec Resources