A.5.9
Inventory of information and other assets
ISO 27001 · ISO/IEC 27001:2022 · Last verified July 2026
Objective
Identify organizational assets, including information, and maintain an inventory that is accurate enough to support the ISMS's risk decisions.
Points of focus
- Cloud infrastructure inventory covers compute, storage, and managed services holding in-scope data
- SaaS/third-party application inventory sourced from the IdP or procurement records, not memory
- Inventory entries carry an owner and, where relevant, a data classification
- Inventory is refreshed on a defined cadence and after significant infrastructure changes
Implementation notes
Treat the inventory as a query against systems of record rather than a manually maintained document: pull cloud resources from Terraform state or the provider's native inventory API, pull SaaS applications from the IdP's connected-apps report, and reconcile against procurement or expense records to catch tools bought outside SSO. Tag each entry with an owner and, where it touches customer or personal data, a classification. Rebuild or reconcile the inventory on a fixed cadence — monthly or quarterly — and whenever a new provider, database, or major service is added. An inventory that's accurate at certification and stale six months later is the most common finding for this control.
Audit tip: Ask for the inventory export's generation date and compare it against a recently added service, such as a new database or SaaS vendor. If the addition isn't reflected, the inventory is stale regardless of how complete it looks.
Evidence auditors typically request:
- Cloud asset export, such as AWS Config or Terraform state, with owner tags
- SaaS application list generated from the IdP's connected-apps report, reconciled against finance or procurement records
- Data inventory or data-flow diagram marking where customer data and PII are stored
- Change ticket showing the inventory was updated after a new service or provider was added
Common gaps
- SaaS tools purchased on a personal or team card never appear in the IdP and are missing from the inventory entirely
- The inventory was built once for certification and hasn't been touched since, so recently added services are absent
- Ephemeral resources such as containers, serverless functions, and short-lived environments aren't captured by a point-in-time inventory
- Entries have no owner, so nobody is accountable when the asset is decommissioned or its risk changes
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.5.9 | This control |
| SOC 2 | CC6.1 | CC6.1 assumes you know what you're protecting — this inventory is usually the first artifact auditors ask for before testing access controls. |
| GDPR | Article 30 | Article 30 records of processing overlap with the data portion of this inventory, but Article 30 also requires processing purposes and legal basis that a pure asset list won't contain — expect to maintain both. |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.5.9)