Governance · Topic 4 of 7
Organizational Asset Management
CRISC asset management: building the asset inventory, assigning owners, classifying and valuing assets, CMDB, shadow IT and why risk starts with assets.
- 4 min
- The asset inventory is the starting point for risk identification.
- Every asset needs a business owner; IT is usually the custodian.
- Asset value includes business impact, not just purchase price.
What it is
Asset management is knowing what the organization has, who owns it, how valuable or sensitive it is, and what it depends on. Assets include hardware, software, data, cloud services, facilities, intellectual property and the people and suppliers that critical processes rely on.
You cannot assess or protect what you do not know exists. The asset inventory is the foundation for risk identification, control selection, business impact analysis and incident response.
How it works
Types of assets
| Asset type | Examples | Typical risk concern |
|---|---|---|
| Information | Customer records, financial data, trade secrets | Confidentiality, integrity, privacy |
| Software and services | Applications, SaaS, APIs, licences | Vulnerabilities, licence compliance, vendor failure |
| Hardware and infrastructure | Servers, laptops, network devices, IoT | Loss, theft, end of support |
| Facilities | Data centres, offices | Physical damage, access |
| People and skills | Key staff, specialist knowledge | Single points of failure, departure |
| Intangible | Brand, reputation, intellectual property | Damage from incidents |
The inventory
An inventory should record, for each asset, a unique identifier, description, owner, location, classification, business processes supported, dependencies and lifecycle status. In IT operations this often lives in a configuration management database (CMDB), which also records relationships between configuration items.
Inventories go stale quickly. Automated discovery tools, procurement and onboarding processes, and periodic reconciliation keep them current. A gap between discovered assets and recorded assets is a useful indicator in its own right.
Ownership
Every asset needs an asset owner who is accountable for its protection, classification and appropriate use. The owner is usually a business manager. A custodian, often IT, looks after the asset day to day by running backups, applying patches and managing access as the owner directs.
| Role | Accountability |
|---|---|
| Asset or data owner | Classifies, approves access, decides acceptable use |
| Custodian | Implements protection the owner requires |
| User | Follows rules for acceptable use |
Classification and valuation
Classification groups assets by sensitivity or criticality, for example public, internal, confidential and restricted. Each level carries handling rules, so protection is proportionate. Data classification is covered further in the Technology and Security chapter.
Valuation estimates what an asset is worth to the business. Value is not just purchase cost; it includes the cost to replace or recreate it, revenue it supports, regulatory exposure if it is compromised, and reputational damage. A cheap database server holding millions of customer records has a very high value for risk purposes.
Shadow IT and lifecycle
Shadow IT is technology adopted without IT or risk involvement, such as a team signing up for a cloud service on a company card. It creates assets with no owner, no classification and no controls. Discovery tools, procurement rules and an easy approval route help bring it into view.
Assets also have an end of life. Unsupported systems no longer receive security patches, and retired equipment may still hold data. Disposal must include secure data destruction and removal from the inventory.
A worked example
During a risk assessment of a marketing department, the practitioner compares the CMDB with expense claims and network logs. Seven cloud services are in use that no one has registered, and one stores customer email addresses and purchase history.
The practitioner records them as assets, asks the marketing director to name owners, and flags the customer data service for classification and a privacy review. The difference between known and discovered assets is added to the risk report as an indicator of control weakness in procurement.
How the exam asks about this
- "What should be done FIRST to identify IT risk in a new business unit?" Establish an inventory of its assets and the processes they support.
- "Who should determine the classification of a data set?" The data owner, usually the business manager responsible for it.
- "Which is the BEST basis for prioritizing protection of assets?" Their value and criticality to the business, as set by classification.
What to remember for the exam
- The asset inventory is the starting point for risk identification.
- Every asset needs a business owner; IT is usually the custodian.
- Asset value includes business impact, not just purchase price.
- Classification drives proportionate protection.
- Shadow IT and unsupported assets are classic sources of unmanaged risk.
An inventory with no owners is only a list. If a question shows assets with no assigned owner, assigning ownership is usually the BEST next step before choosing controls.
Common mistakes
Valuing assets at book cost. Risk value comes from what the asset supports and what its loss would cost the business.
Making IT the owner of business data. IT protects data on the owner's behalf; the business decides classification and access.
Treating the inventory as a one-off project. Without discovery and reconciliation it becomes wrong within months.
Check yourself
Why is the asset inventory important for risk management?
Risk identification, impact analysis and control selection all depend on knowing which assets exist and what they support.
What is the difference between an asset owner and a custodian?
The owner is accountable for classification and access decisions; the custodian carries out day to day protection as the owner directs.
Why is shadow IT a risk?
It creates assets with no owner, classification or controls, so their risk is never assessed or managed.
Topic 4 of 7 in Governance
Test yourself on Governance
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.