The organization is to build and keep current an inventory of its information and other associated assets, with their owners recorded. Purpose: know what information and associated assets exist so they can be protected and given suitable owners. Guidance: identify the assets, judge their security importance and record them in dedicated or existing inventories that are accurate, current, consistent and reconciled with each other, using periodic checks against reality or automatic updates whenever an asset is installed, changed or removed; record location where relevant. The inventory may be a set of dynamic lists kept by different functions (information, hardware, software, virtual machines, facilities, personnel, competence, capabilities, records), each asset classified in line with the information it carries (5.12), at a level of detail that suits the organization, accepting that short-lived items such as individual VM instances may not be listed. Ownership: each asset is given an individual or group owner and a classification, promptly on creation or transfer into the organization, and reassigned when owners leave or move. Owner duties across the life cycle: see that assets are inventoried, classified and protected; review the classification periodically; list and link the supporting components of technology assets (databases, storage, software components); set acceptable use requirements (5.10); make sure access restrictions match the classification, work and are reviewed; ensure secure deletion or disposal and removal from the inventory; take part in managing risks to their assets; and support the people who manage their information. Other information: inventories also serve health and safety, insurance, finance, risk, audit, vulnerability management, incident response and recovery; custodians can do daily tasks but the delegator stays accountable; grouping assets by service makes the service owner accountable; ISO/IEC 19770-1 and ISO 55001 give further detail.
This control maps to 122 controls across 43 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 5.9 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 122 it maps to, and the evidence behind each claim, over MCP and REST.