How to write an asset management policy

Why the inventory comes first

You cannot protect what you do not know you have. An asset management policy defines how you identify, own and track information assets — hardware, software, data and cloud services — across their lifecycle. It underpins almost every other control, which is why auditors start here.

What to include

Scope — asset types covered (devices, servers, SaaS, data stores, cloud resources).
Inventory — a maintained register with key attributes (owner, location, classification, criticality).
Ownership — every asset has a named owner accountable for its protection.
Lifecycle — acquisition, deployment, maintenance, and secure disposal/wiping.
Acceptable use — link to your acceptable use policy.
Return of assets — recovery on offboarding.
Review — periodic reconciliation of the inventory against reality.

Common mistakes

A one-off inventory that is never updated.
Assets with no owner, so no one is accountable.
Forgetting SaaS and cloud resources, which now dominate the estate.

Framework alignment

Maps to ISO 27001:2022 Annex A 5.9–5.11 (inventory, ownership, return of assets), the SOC 2 criteria, and NIST CSF Identify (ID.AM).

Primary sources

ISO/IEC 27001:2022 — Annex A controls 5.9–5.11, inventory and acceptable use of assets (iso.org/standard/27001).
NIST — Cybersecurity Framework, Asset Management (ID.AM) (nist.gov/cyberframework).
CISA — asset management and visibility guidance (cisa.gov).

Generate it in minutes

See a sample asset management policy or generate yours free.

Frequently asked questions

What counts as an information asset?

More than hardware. An information asset is anything of value to the organisation: devices and servers, but also data sets, applications, cloud services, and the people and documentation that support them. Annex A 5.9 expects an inventory of these assets with an owner assigned to each.

Why does every asset need an owner?

Without a named owner, no one is accountable for classifying the asset, approving access, or retiring it safely. Annex A 5.9 requires ownership precisely so decisions about protection and disposal have a responsible person, rather than falling through the cracks between teams.

How does asset management connect to other controls?

The inventory is the foundation for almost everything else: you cannot classify data, patch systems, or revoke access for assets you do not know you have. Acceptable use (Annex A 5.10) and secure disposal (Annex A 7.14) both build directly on an accurate asset register.