ISO 27001 Annex A 5.9: Asset Inventory Requirements in Practice

You cannot protect what you do not know you have — and you cannot certify it either. Every information security management system stands on an asset inventory: the risk assessment scopes it, the Statement of Applicability assumes it, and dozens of other controls — acceptable use, return of assets, secure disposal, endpoint protection — inherit its accuracy. That is why ISO/IEC 27001:2022 places the inventory near the top of Annex A as control 5.9, and why experienced auditors go straight to it.

What control 5.9 says — and where it came from

Annex A control 5.9 requires that an inventory of information and other associated assets, including owners, shall be developed and maintained. The 2022 revision consolidated two controls from the 2013 edition — A.8.1.1 (inventory of assets) and A.8.1.2 (ownership of assets) — into one organisational control within the restructured Annex A of 93 controls. Since the transition window for 2013-edition certificates closed at the end of October 2025, every ISO 27001 audit now runs against this wording. Three phrases carry the weight:

• “Information and other associated assets” — not just data. Hardware, software, services, facilities and people-dependent assets that store or process information are in scope: the laptop fleet, the comms rooms, the SaaS estate, the backup drives in the safe.
• “Including owners” — every asset needs a named owner accountable for its classification, handling and lifecycle. Unowned rows in the register are audit findings in waiting.
• “Developed and maintained” — a point-in-time spreadsheet satisfies neither verb. The supporting guidance in ISO/IEC 27002:2022 expects the inventory to be accurate, up to date and consistent with other inventories, with reviews at planned intervals.

What certification auditors actually test

Audit method is straightforward and unforgiving — sampling in both directions:

1. Floor to record. The auditor picks devices in the office — a laptop, a switch, a printer — and asks to see them in the inventory, with the right owner, location and classification.
2. Record to floor. The auditor picks rows from the inventory and asks to be shown the physical asset. Ghost records — devices long disposed of, lost or sitting with ex-employees — surface here.
3. Process evidence. When was the inventory last verified against reality? Who reviewed it? How do joiners-movers-leavers, procurement and disposal feed it? Recurring nonconformities cluster on exactly these questions.

This is where tool-only inventories fail. Network discovery, MDM and agent-based tools are necessary — but they only see what is powered on, connected and instrumented. The drawer of leaver laptops, the spare switches in the store room, the decommissioned server still racked: invisible to the tool, fully visible to the auditor walking the floor. The fix is the one used for financial assets for decades: a physical, wall-to-wall count reconciled against the system records — floor-to-record and record-to-floor — exactly the discipline behind our IT asset inventory & audit services in the UAE and our broader fixed asset verification practice.

Building an inventory that passes — and stays passed

• Baseline physically. Count everything once, wall to wall, and tag as you go — barcode, QR or RFID (see asset tagging services in the UAE) — so every subsequent verification is a scan, not an archaeology project.
• Reconcile the three layers. Physical count, discovery/MDM output and the CMDB or asset register must agree; exceptions get investigated, not overwritten.
• Assign owners as data, not prose. Owner is a mandatory field keyed to the HR record, so leavers automatically orphan their assets into a review queue.
• Set a verification cadence. Annual full counts plus cycle counts for mobile, high-risk classes; quarterly for removable media if your risk assessment says so. Document the cadence and keep the count reports — they are the audit evidence.
• Connect lifecycle events. Procurement, deployment, transfer, repair and disposal each update the inventory in-flow, with secure-disposal certificates attached to the record.

The UAE overlay: PDPL, DIFC and ADGM

For UAE organisations, control 5.9 does double duty. The UAE Personal Data Protection Law — Federal Decree-Law No. 45 of 2021 — expects controllers to implement appropriate technical and organisational measures and to know where personal data is processed and stored. The financial free zones run their own regimes with the same dependency: the DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 both assume you can map personal data to the systems and devices that hold it. An asset inventory that is wrong about devices produces a data map that is wrong about data — and a breach response that starts with “we did not know that server existed”. Government and critical-infrastructure entities add the UAE Information Assurance Standards, where asset management is a baseline control family. One physically verified inventory, maintained well, feeds all of these programmes plus the seven-year record-keeping the FTA expects behind IT assets in the corporate tax computation.

Where CPCON fits — and where we deliberately do not

CPCON is not a certification body, and we make no claim to ISO or SOC certifications of our own. Certification belongs to your organisation and its accredited auditor. Our role is the part no tool and no policy can do from a desk: 30 years and 4,500+ projects of physical inventory discipline, applied to your estate — the wall-to-wall count, the tagging, the three-way reconciliation and the evidence pack your auditor samples under control 5.9. Banks have used us for exactly this at scale; see how a banking leader improved IT asset visibility.

Frequently asked questions