Asset management is a key part of maintaining privacy protection, on a physical and digital level.
Organisations need to maintain crystal clear records of all relevant assets, in order to gain a top-down view of how PII and privacy-related data is flowing through the organisation.
Personnel who use any asset within an organisation’s ICT that has the ability to store or process PII should be made explicitly aware of what’s expected of them in terms of acceptable use and how such information is managed during an off-boarding period.
ISO 27701 6.5 contains four sub-clauses that deal specifically with privacy protection, within the context of asset management.
Each sub-clause relies on guidance contained within various sub-clauses of ISO 27002, with two sub-clauses containing the exact same guidance points:
ISO provides no additional guidance for PIMS-related activities, within the scope of asset management, nor are there any GDPR ramifications to take into account.
To increase privacy protection, organisations should maintain an accurate, up-to-date, documented list of information and assets, including the ability to reference inventories across the organisation.
There are several ways in which organisations can improve their inventory operation, including:
Inventories don’t need to be one large list of every physical and digital asset held. Instead, ISO encourages organisations to segregate out inventories on a category-by-category basis, including separate inventories for:
It’s important to note that – in the case of certain assets – not all information is able to be regularly maintained, and there isn’t a need to include every last asset across the organisation’s entire physical and digital holdings – e.g. short-lived VMs that carry out a singular purpose for a short time, before being removed.
All categorised assets should be given an official ‘owner’ – be that an individual, or a group (see ISO 27002 5.12 and 5.13) – which should change when job roles commence, cease or are amended.
Asset owners should ensure that:
See ISO 27701 clause 6.5.1.1
All personnel within the organisation who handle information or physical and digital assets should be made explicitly aware of their responsibilities towards privacy protection, including any general or topic-specific security requirements.
Acceptable use policies should clearly outline:
Procedures should be implemented that take into account the full lifecycle of PII, including:
Asset management procedures also need to include explicit guidelines on how the organisation manages the return of assets that have been involved in the processing or storage of PII, and other privacy-related information.
Whether personnel have used their own devices, or have been assigned an organisational asset, processes need to be put in place that safeguard PII by removing the data from the asset in question, and transferring information back to the organisation.
If personnel are subject to a notice period, organisations should take steps to ensure that PII is not compromised in any way by the off-boarding employee – including unauthorised sharing, transferring or deletion.
Organisations should develop workflows that cover the return of all assets involved with processing or storing PII, including (but not limited to):
| ISO 27701 Clause Identifier | ISO 27701 Clause Name | ISO 27002 Control | Associated GDPR Articles |
|---|---|---|---|
| 6.5.1.1 | Inventory of Assets | 5.9 – Inventory of Information & Other Associated Assets for ISO 27002 | None |
| 6.5.1.2 | Ownership of Assets | 5.9 – Inventory of Information & Other Associated Assets for ISO 27002 | None |
| 6.5.1.3 | Acceptable Use of Assets | 5.10 – Acceptable Use of Information & Other Associated Assets for ISO 27002 | None |
| 6.5.1.4 | Return of Assets | 5.11 – Return of Assets for ISO 27002 | None |
How do we help?
By adding a PIMS to your ISMS on the ISMS.online platform, your security posture remains all-in-one-place and you’ll avoid duplication where the standards overlap.
With your PIMS instantly accessible to interested parties, it’s never been easier to monitor, report and audit against both ISO 27002 and ISO 27701 at the click of a button.
Find out how much time and money you’ll save on your journey to a combined ISO 27002 and 27701 certification using ISMS.online.
Find out more by booking a hands on demo.
Book a tailored hands-on session
based on your needs and goals
Book your demo
We can’t think of any company whose service can hold a candle to ISMS.online.
