Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Information Asset Identification and Valuation
The foundation of everything
Risk assessment needs a list of assets. So do classification, access control, backup, incident response and recovery. If the inventory is incomplete, every one of those has blind spots. That’s why information asset identification and classification is a named topic at the start of the program, and one CISM task is to establish and maintain a process for information asset identification and classification.
What counts as an asset
| Type | Examples |
|---|---|
| Information | Customer and employee data, intellectual property, financial records |
| Systems and services | Applications, databases, cloud and SaaS services, networks, devices |
| People and knowledge | Key staff, skills, documented procedures |
| Intangibles | Reputation, brand, customer trust, licences and certifications |
Cloud services, SaaS subscriptions and shadow IT (systems bought or built outside IT) must be included, or they become unmanaged risk.
Valuing assets
Asset value is about business impact, not purchase price:
- replacement cost: rebuilding systems, recreating or re-entering data
- revenue dependence: what stops if the asset is unavailable?
- legal and regulatory: fines and duties if it leaks or is lost
- competitive value: harm if a competitor had it
- reputation: customer trust and brand
Example. The pricing model is a spreadsheet maintained by two analysts. It cost nothing to build, but if it leaked to a competitor or were corrupted before a tender, the company could lose millions. Its owner rates it as critical.
Keeping the inventory complete
- Discovery tools: network scans, endpoint agents and cloud APIs find what’s actually there.
- Procurement: new purchases and SaaS subscriptions are recorded at the point of buying.
- Change management: new and retired systems are updated with each change.
- Reconciliation: compare discovery results with the inventory and investigate the differences.
Owners make it work
- Every asset has a named owner, a person rather than a department.
- The owner sets value and classification.
- The owner approves access and accepts residual risk.
- Assets without owners are escalated, not ignored.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step in developing an information security program | Identify and inventory information assets |
| Basis for an asset’s value | Business impact if it’s compromised |
| Who assigns value and classification? | The asset owner |
| Best way to keep the inventory complete | Automated discovery reconciled with the inventory |
| Unapproved SaaS is discovered | Bring it into the inventory, assess it, assign an owner |
In short
- You can't protect what you don't know you have: identifying assets is the foundation of risk assessment, classification and controls.
- Information assets include data, systems and services, people and knowledge, and intangibles such as reputation.
- Every asset needs a named owner who is accountable for it and decides its value and classification.
- Asset value is based on business impact (revenue, legal, competitive, reputational), not on purchase price.
- The inventory is kept current through discovery tools, procurement and change processes, and regular reconciliation.
- Cloud services, SaaS and shadow IT must be included, or they become unmanaged risk.
Exam traps
- The first step in protecting information is identifying it, not buying controls.
- Asset value isn't the cost of the hardware; it's the impact on the business.
- An inventory without owners can't drive protection decisions.
- A one-off inventory goes stale quickly; it must be maintained.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What counts as an asset
Valuing assets
ExampleThe pricing model is a spreadsheet maintained by two analysts. It cost nothing, but if it leaked to a competitor or were corrupted before a tender, the company could lose millions. Its owner rates it as critical.
1 / 9