Monetary Authority of Singapore Technology Risk Management Guidelines 3.3: 3.3 Management of Information Assets

To keep an accurate and complete view of its IT environment the FI should identify the information assets (data, hardware and software, including those entrusted by customers or third parties, leased, or used by service providers to serve the FI) that support its business; classify them by security classification or criticality; assign ownership and the roles of staff managing them; and set policies, standards and procedures to manage them according to classification. An inventory of all information assets should be maintained, reviewed periodically and updated whenever there are changes.