Skip to content
Database systems
ASD ISMISM-1243

ASD ISM 1243 Develop and verify database register

What it says

A database register is developed, implemented, maintained and regularly verified.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Maintain an up-to-date list of databases and check it regularly to ensure accuracy.

Keeping a current list of databases and checking it regularly ensures you know where your important information sits. If you overlook this, you might miss a vulnerability that hackers could exploit, leading to potential data breaches.

Why it matters

An outdated database register could lead to data breaches, risking confidential data and the organisation's reputation.

How to implement

  1. Business owners should appoint a responsible person or team to maintain the database register.

    They should gather details about each database, such as its location, purpose, and who can access it, and record this in a shared document.

  2. IT staff should schedule regular updates to the database register.

    They can set a monthly reminder to check with database managers if there have been any changes or if any new databases need to be added.

  3. HR should work with IT to educate employees on why maintaining an accurate database register is crucial.

    They can organise short training sessions to explain how every employee's actions contribute to overall data security.

  4. Database managers should verify the register's entries weekly to ensure accuracy.

    This involves cross-checking with actual databases by referring to system configurations and confirming they align with the register.

  5. Auditors should provide oversight by reviewing the entire register quarterly.

    They should compare it against any contracts or vendor agreements to ensure nothing has been omitted.

Keep it running

Regular checks of the database register help ensure it stays up-to-date, reflecting new additions and changes promptly.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    the latest version of the database register.

    Look at

    the entries for each database, including details like location, purpose, and responsible personnel.

    Good evidence

    A comprehensive list with all relevant details filled out and dates of last review.

  2. Check 2 of 5What an auditor asks for

    Look at

    attendance or distribution lists showing who received information.

    Good evidence

    Documented training sessions or emails reaching relevant staff.

  3. Check 3 of 5What an auditor asks for

    Ask for

    logs of register updates or changes over the past months.

    Look at

    timestamps and notes on what was modified.

    Good evidence

    Clear log entries showing regular updates and specific changes made with timestamps.

  4. Check 4 of 5What an auditor asks for

    Ask for

    a list of new databases added in the past six months.

    Look at

    matching entries in the register and any supporting documentation.

    Good evidence

    Each new database has an entry in the register with consistent supporting documents.

  5. Check 5 of 5What an auditor asks for

    Look at

    signed-off audit reports or review notes.

    Good evidence

    Dated reports with sign-offs from the auditing staff confirming all entries are verified.

Mappings

Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.9Inventory management of information and associated assetsPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.