Asset Management and Classification
What this domain tests
Asset management and classification tests whether information and supporting assets are inventoried, owned, classified, labeled, and handled according to value and legal sensitivity.
Core rules
- Inventory covers hardware, software, data, services, cloud instances, and media.
- Each asset has an owner, location, criticality, and lifecycle status.
- Classification schemes should be simple enough to use, such as public, internal, confidential, and restricted.
- Classification drives handling: storage, transmission, sharing, retention, and disposal.
- Labeling makes handling rules visible; metadata can label data in repositories.
- Acceptable use defines permitted employee use and consequences.
- Media sanitization must match the media and sensitivity; deleting files is not sanitization.
- Shadow IT is an asset management failure, not just a policy breach.
Worked example
HR stores payroll data in a shared drive. The data owner classifies it 'restricted' because of salary and bank details. The standard requires encryption at rest, access limited to HR payroll roles, and no external sharing. The custodian enables restricted permissions, labels the folder, and sets retention. A manager requests a copy for budgeting; the request is denied unless the data is aggregated and de-identified. Reasoning: classification precedes handling, and the owner sets the rules.
Traps
- Keeping an inventory without owners.
- Creating too many classification levels for staff to apply consistently.
- Applying labels that are not enforced by controls.
- Disposing of drives by deleting files.
- Failing to track cloud and shadow IT assets.