Asset Security, Risk, and Data Protection
What the exam tests
Asset Security, Risk, and Data Protection tests how the asset register itself is protected and how asset data supports risk, privacy, and security obligations.
Core rules
- The asset register is sensitive: it maps hardware, owners, locations, and software versions - a ready-made target list. Classify it and restrict access on a need-to-know basis.
- ISO/IEC 27001:2022 expects an inventory of information and associated assets with named owners. Ownership is a security control, not an administrative nicety.
- Data protection principles apply to asset records containing personal data: minimize, define retention, and control disclosure.
- Risk management links each asset to likelihood and impact. High-value or internet-facing assets need tighter controls and more frequent verification.
- Secure disposal and media sanitization close the confidentiality risk at end of life; certificates are the evidence.
Worked example
A vendor requests an asset-register export to quote a support renewal. The register includes employee names, office locations, and OS patch levels. The analyst classifies the extract as confidential, removes personal data not needed for the renewal, shares a minimized file through an access-controlled portal with an expiry date, and logs the disclosure. The vendor receives serial numbers and model data only - enough to quote, not enough to build a target list.
Traps that cost marks
- Treating the asset database as low-sensitivity because it is just inventory.
- No named owner for critical assets, so accountability disappears.
- Disposal without sanitization evidence.
- Shadow IT: assets bought outside procurement never enter the risk assessment.