ISO 27001 Annex A 5.9 Inventory management of information and associated assets

This control partially overlaps A.4.3.

Annex A 4.3 requires the organisation to document information about the data resources utilised for an AI system as part of resource identification. Annex A 5.9 similarly requires an inventory of information and associated assets (including owners), which can include AI training, test and operational datasets and data pipelines. The overlap is on identifying and documenting data as an organisational resource, but Annex A 4.3 is AI-system specific (including AI lifecycle context), while Annex A 5.9 is a general information asset inventory control.

This control partially overlaps A.4.4.

Annex A 4.4 requires the organisation to document the tooling resources utilised for each AI system as part of AIMS resource identification. Annex A 5.9 requires an inventory of information and other associated assets (including owners), which can encompass AI tooling as an asset class (e.g. software tools, platforms, and services) and provides governance structure for maintaining that inventory. Annex A 5.9 is broader and not AI-specific, whereas Annex A 4.4 is narrower but requires AI-system linkage (which tools support which AI system and for what lifecycle activities).

This control is broader than ISM-0208.

ISM-0208 requires a cable register recording, for each cable, its identifier, colour, sensitivity or classification, source, destination, location and any seal numbers. A cable register is a specific inventory of cabling assets, so maintaining it contributes directly to the inventory of information and associated assets required by Annex A 5.9. Annex A 5.9 covers all information and associated assets and requires owners to be recorded, which the cable register does not specify.

This control is broader than ISM-1071.

Annex A 5.9 requires developing and maintaining an inventory of information and associated assets, including identifying owners. ISM-1071 (Assign System Ownership for Better Oversight) supports the ownership aspect of Annex A 5.9 by requiring that each system have a system owner assigned, which is an important inventory attribute. However, ISM-1071 does not itself require maintaining a comprehensive asset register.

This control is broader than ISM-1869.

ISM-1869 requires an organisation to develop, implement, maintain and regularly verify a register of non-networked IT equipment. ISO/IEC 27001:2022 Annex A 5.9 requires an inventory of information and associated assets (including owners) to be developed and maintained, which can and should include non-networked equipment. ISM-1869 is more specific in scope (non-networked equipment) and adds an explicit verification expectation, while Annex A 5.9 is broader across all information assets.

This control partially meets ISM-1543.

ISM-1543 requires an authorised RF and IR device register for SECRET and TOP SECRET areas to be developed, maintained, and regularly verified. Annex A 5.9 requires an organisation-wide inventory of information and associated assets (including ownership) to be developed and maintained, which can encompass RF/IR devices as a subset of assets. ISM-1543 is more specific in both asset type (RF/IR) and context (classified secure areas) and adds an explicit verification cadence requirement not stated in Annex A 5.9.

This control partially overlaps ISM-0336.

Annex A 5.9 requires developing and maintaining an inventory of information and associated assets, including ownership. ISM-0336 (Maintain a Comprehensive IT Equipment Register) overlaps by requiring a maintained register of networked IT equipment. It is foundational but limited to IT equipment.

This control partially overlaps ISM-1243.

Annex A 5.9 requires an inventory of information and associated assets, including ownership. ISM-1243 (Develop and Maintain a Database Register) overlaps by requiring a regularly verified register of databases, key information repositories. ISM-1243 is narrower, covering only databases.

This control partially overlaps ISM-1493.

Annex A 5.9 requires developing and maintaining an inventory of information and associated assets, including owners. ISM-1493 (Ensure Regular Updates of Software Registers) overlaps by requiring registers of installed software to be developed, maintained, and verified. However, ISM-1493 covers only software.

This control partially overlaps ISM-1637.

Annex A 5.9 requires an organisation-wide inventory of information and associated assets with ownership. ISM-1637 (Maintain a Cloud Service Register for Outsourcing) overlaps by requiring a register for outsourced cloud services that is maintained and regularly verified, which is a type of asset inventory. However, ISM-1637 is limited to outsourced cloud services.

This control partially overlaps ISM-1638.

Annex A 5.9 requires maintaining an inventory of information and associated assets with ownership. ISM-1638 (Maintain a Comprehensive Outsourced Cloud Service Register) overlaps by mandating detailed inventory fields for outsourced cloud services. ISM-1638 is limited to cloud services and adds supplier/contact/security-assessment detail beyond Annex A 5.9's scope.

This control partially overlaps ISM-1713.

Annex A 5.9 requires an inventory of information and associated assets, including ownership, to be developed and maintained. ISM-1713 (Maintain and Verify a Removable Media Register) overlaps by requiring a maintained and regularly verified register for removable media, a specific asset category within an inventory. ISM-1713, however, focuses on removable media tracking.

This control partially overlaps ISM-1737.

Annex A 5.9 requires maintaining an inventory of information and associated assets, including ownership. ISM-1737 (Maintain a Comprehensive Managed Service Register) overlaps by mandating a detailed register for managed services, including purpose, data sensitivity/classification, and contacts, which are inventory attributes. However, ISM-1737 is narrower to managed services and adds third-party/security-assessment fields not covered by Annex A 5.9.

This control partially overlaps ISM-1966.

Annex A 5.9 requires maintaining an inventory of information and associated assets, including ownership. ISM-1966 (Register Management of Organisational Systems) overlaps by requiring a maintained and regularly verified register of systems, which is a major subset of asset inventory. However, it is limited to systems and assigns responsibility to the CISO, while Annex A 5.9 extends to various asset classes.

This control supports ISM-1525.

Annex A 5.9 mandates a maintained inventory of information and associated assets and their owners. ISM-1525 (Register Systems with Authorising Officers) supports this by establishing an organisational process that records systems with an authorising officer. ISM-1525 focuses on governance, but does not cover all asset types comprehensively as Annex A 5.9 does.

This control supports ISM-1551.

Annex A 5.9 requires developing and maintaining an inventory of information, associated assets, and owners. ISM-1551 (Develop and Maintain IT Equipment Management Policy) supports this by establishing policies governing equipment identification, recording, ownership, and maintenance. However, ISM-1551 is policy-focused and does not explicitly define a complete asset inventory.

This control supports ISM-2005.

Annex A 5.9 requires an accurate and maintained inventory of information and associated assets, including ownership. ISM-2005 (Understand Critical Systems and Their Security) is supported by having such an inventory because executives cannot grasp system criticality without reliable records. ISM-2005 focuses on governance and does not directly require a formal inventory.

This control is equivalent to IT.IDE-01.2.

IT.IDE-01.2 requires current records of infrastructure, operating systems, applications, identities, credentials and data assets. This substantially overlaps with ISO/IEC 27001 Annex A 5.9, which requires an inventory of information and other associated assets to be developed and maintained. Annex A 5.9 also requires asset owners to be identified, while IT.IDE-01.2 explicitly extends record keeping to identities and credentials.

This control is broader than IT.IDE-01.1.

IT.IDE-01.1 requires the organisation to use an approved asset inventory mechanism that supports automated discovery to detect new and changed physical and non-physical assets. This is a specific means of developing and maintaining the inventory of information and other associated assets required by ISO/IEC 27001 Annex A 5.9. Annex A 5.9 also requires asset owners to be recorded, while IT.IDE-01.1 adds the specific expectation of automated discovery.