The two standards use asset differently: ISO/IEC 20000-1 takes the ISO/IEC 19770-5 definition (something with potential or actual value) with a single minimal asset management requirement for the assets that deliver services, while ISO/IEC 27001 uses the ordinary sense, treating information and the resources that hold or carry it (even a data cable) as relevant to risk assessment. Neither requires every asset to be listed individually; grouping into types is allowed, and the descriptions should be as consistent as the organisation can make them. At the start of integration a decision should be taken on how assets will be classified, categorised and identified so that references are unambiguous. ISO/IEC 20000-1's configuration items (elements that need control to deliver a service, per its 8.2.6) overlap with assets, and configuration information resembles the ISMS asset inventory from a different angle; configuration management can help classify and manage the information inside the ISMS, and the organisation should manage the availability, integrity and confidentiality of configuration information and baselines, which can carry security-relevant content. Amendment 1 adds that ISO/IEC 27001:2022 control 8.9, configuration management, which aims to keep hardware, software, services and networks working with the required security settings and protected from unauthorised or incorrect change, uses the same term as ISO/IEC 20000-1 in a different sense, and no relationship between the two concepts should be assumed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.