Is an asset inventory mandatory for ISO 27001 certification?

Practically, yes. Annex A controls are selectable via the Statement of Applicability, but excluding A.5.9 requires justifying why your ISMS can manage risk without knowing what assets exist, a justification no auditor is likely to accept. Treat the inventory as mandatory and spend your energy on making it true rather than arguing scope.

What changed between ISO 27001:2013 and 2022 for asset management?

The 2013 edition spread asset management across domain A.8: A.8.1.1 inventory, A.8.1.2 ownership, A.8.1.3 acceptable use, A.8.1.4 return of assets. The 2022 edition consolidated inventory and ownership into A.5.9, moved acceptable use to A.5.10 and return of assets to A.5.11. The obligations are substantively the same; the numbering and grouping changed.

Does A.5.9 cover information itself or just equipment?

Both, and this is the most commonly failed nuance. The control names an inventory of information and other associated assets: the information, plus the hardware, software, services, and facilities that store or process it. A register that lists laptops but not the customer database, or SaaS tools but not the data inside them, covers half the control.

How current does the register have to be?

The standard says inventories should be accurate and up to date, without fixing a frequency. Auditors read that through your own policy: if you committed to quarterly review, they sample for quarterly evidence. A dated review log plus a reconciliation mechanism, agent, MDM export, or manual spot check, is what up to date looks like as evidence rather than assertion.

Does OnTrackio make us ISO 27001 certified?

No. Certification is an accredited auditor's judgment of your whole ISMS. OnTrackio maintains the asset register with owners, classification, and review history, and exports it as evidence mapped to the asset controls, which is one control family done well, not a certificate.

ISO 27001 A.5.9: the asset inventory, control by control

2026-07-18

A.5.9 is eleven words long: “an inventory of information and other associated assets, including owners, shall be developed and maintained.” Certification audits fail on those eleven words with impressive regularity, and almost never because a register is missing entirely. They fail on what the register leaves out, who it fails to name, and how stale it turns out to be under sampling. This guide covers what the control asks, what auditors actually test, and where the free register template fits.

What A.5.9 actually requires

Unpack the eleven words and four obligations fall out:

Obligation	Where teams fail it
Inventory information assets	The register lists devices but not the data: no customer database, no contract repository, no source code
Inventory associated assets	SaaS services, outsourced processing, and supporting utilities are missing because nobody “owns” buying them
Name an owner per asset	Rows say “IT” or a team name; the control means an accountable individual
Maintain it	The register was a certification-week project in 2024 and has not been touched since

If you certified under the 2013 edition, the lineage matters for your documentation: A.5.9 merges old A.8.1.1 (inventory) and A.8.1.2 (ownership). Acceptable use moved to A.5.10, and return of assets at termination moved to A.5.11. Update your Statement of Applicability’s cross-references when you transition; auditors notice stale numbering because it signals a paper ISMS.

The “information and other associated assets” trap

The most common structural failure is a hardware-only register. The control’s own wording puts information first: the inventory is of information and the assets associated with it. A defensible register therefore spans at least four categories: information (databases, repositories, key document sets), hardware (the fleet), software and services (installed and SaaS, with the data classes they touch), and outsourced services that process your information. One register with a category column beats four spreadsheets, because ownership and review discipline only survive in one place. That is how the template is structured, and it mirrors how our own product’s register treats hardware, software, and licenses as one estate.

What the auditor samples

Certification and surveillance audits rarely read a register end to end. They sample, and the samples are predictable:

The ownership probe. Pick rows, ask “who is this owner, do they know they own it, what did they last decide about it?” An owner who has never heard of the asset is a finding dressed as a conversation.

The freshness probe. Pick a device from the register and ask to see it, or pick a real device from the office and find it in the register. Then check the review log against your own stated cadence. Your policy, not the standard, sets the bar you get measured against.

The completeness probe. Take a system named in your risk assessment or a vendor from your supplier list and find it in the register. Cross-document consistency is where paper ISMSes come apart.

The leaver probe. A.5.11’s return-of-assets obligation gets tested against the register: pick a leaver, show the returned items and dates. This is the same evidence a SOC 2 audit samples, which we covered in the offboarding evidence guide; one honest record serves both.

Register fields that survive sampling

The template ships twelve columns; the load-bearing ones are the asset category (keeps information assets in scope), the named owner, the classification against your scheme, the acceptable-use reference (bridges A.5.10), the return-required flag (bridges A.5.11), and the last-reviewed date. Nothing exotic: the control is not hard to satisfy, it is hard to keep satisfied, which is a maintenance problem before it is a documentation problem.

Where this meets NIS2 and SOC 2

If ISO 27001 is your anchor framework, the same register carries further than you might expect: the NIS2 Implementing Regulation’s asset-management section asks for substantially the same record with a heavier freshness expectation, mapped field by field in our NIS2 evidence guide, and SOC 2’s CC6.1 points of focus expect the same inventory-classify-manage loop. The differences are packaging and cadence, not substance. This is the design bet behind OnTrackio: one agent-reconciled register, with owners, classification, and a change history, exported in whichever framework vocabulary the audit speaks. Pricing is public if you want the version that maintains itself; the template is free either way and carries the same spine.