Cataloguing Your First Information Assets
Where to start when your asset register is empty: which assets to log first, how to classify them, and why ownership matters.
Start with What Matters Most
You don't need to inventory every laptop and cable on day one. Start with the assets that, if compromised or lost, would cause the most damage — your customer database, your core application, the cloud accounts that hold everything else together. Build outward from there as your ISMS matures.
A Reasonable First Batch
- Your primary database or data store — where customer or employee data lives.
- Core application(s) — the software your business runs on.
- Cloud infrastructure accounts — your AWS/Azure/GCP account, and any admin-level SaaS accounts (identity provider, email, source control).
- Company device fleet — laptops and mobile devices, logged as a group if individually cataloguing every device isn't practical yet.
- Key third-party services — payment processors, hosting providers, anything you'd be in trouble without.
Adding an Asset
Click Add Asset and choose a type (hardware, software, data, people, service, or facility), give it a classification (public, internal, confidential, or restricted — based on the impact if it were exposed), and assign an owner. The owner doesn't need to be the most technical person — they need to be accountable for keeping the asset properly protected and reviewed.
Once you have a handful of assets logged, link them to relevant entries in your Risk Register — this is what turns a static inventory into something that actually drives your risk assessment. See Asset Register for the full classification scheme and ISO 27001 mapping.