Information Asset Inventory

Many information asset inventories are produced and organized in view of the business processes they support or are involved with, and this provides a useful starting point for investigation.

An organization's annual budget is an example of an information asset. This budget may exist as many different data entries within several databases, some of which are directly managed by financial applications. The overall budget planning, review, and approval process may produce any number of working products, from "what-if" spreadsheet illustrations of spending plans to more complex simulations of revenues and costs. Taken together, these files, databases, and printed versions make up the "annual budget information asset." This may require an inventory entry for each year's budget (including those in archival storage), so that planners and security analysts can appreciate how many kinds of data objects, in how many locations, might need some kind of security protections.

This case is, unfortunately, typical of most modern organizations. As a result, building the information asset inventory from a top-down perspective begins with a set of critical business processes used to identify sets of information needed as input, as retained corporate memory, and as outputs to other business units, to outside stakeholders, and to the process's own memory updates.

Other forms of information assets may be easier to identify, locate, and add to the inventory:

• Process control data, such as logs of instrument readings and commands, is generally produced as sets of files by the control systems themselves. These might be organized and cataloged by systems, by products, or by some other characteristic.
• Network and systems security information and monitoring data may be produced by almost every device and application on the organization's networks.

Systems enumeration tools should identify what applications are installed, their authorized users, and where in the storage networks and subsystems the various files used by the databases that support those applications reside. However, those tools cannot tell you where this year's budget, viewed as a set of information that needs security protection, is kept. Nor can enumeration tools help find all the spreadsheets, document files that contain spreadsheets (as objects or as figures), or emails that discuss the arguments for the decisions that are reflected in the approved budget.

• Customer transaction data, including access to their online or kiosk service points, are usually kept in the applications and databases that support them.

Key to taking an information asset inventory is to relate a business or organizational process, and its respective priority and risk assessment, to a set of information needed, produced, modified, outputted, or retained by that process.

After all, most business owners and operators think in terms of doing things-for example, manufacturing or using goods and systems and moving materials or people to different locations. They recognize that taking these actions requires decisions, and decisions require and produce information (as do the actions themselves). But their focus as business operators has long been on the actions and the things, and thus on the processes that people need to do to make those actions take place.

As an example, both tangible and intangible assets are of equal importance to a hotel chain. The firm owns valuable real estate and buildings, but it also owns customer registries and records. These are physical and data assets. This includes things like linens, coffee, and televisions, but what about the versions of operating systems installed on devices or the serial numbers of desktop computers or servers or license renewals for applications? These are essential as well.

When considering risk and business impact, asset registers are vital. Even a lack of coffee at a hotel can have an impact on the organization's reputation. So keeping track of this physical asset matters as much as tracking a guest's marketing records.

An organization's assets are many and varied, and while some will appear on the company balance sheet, others will not. The most important point to realize is that an organization has assets that are tangible (physical), but that the organization also has intangible assets that are equally important and essential to valuation and operational needs. And all the assets require management, including an asset inventory itself.

Configuration Management Databases (CMDBs) include needed information such as makes, models, serial numbers, asset type numbers, and version numbers. The creation of the CMDB allows the | organization to track the asset, but also provides a restoration point if there is a need, for example, to rebuild a user's laptop to the correct version, including hardware, software, and versions. The CMDB is not only an inventory of assets but also includes what an organization has and how it is configured. The registers are also assets themselves and need to be protected and maintained.