Information Asset Register

Central register of systems, data and infrastructure covered by the ISMS

1. Register Management Principles

Each asset is assigned to an owner responsible for its security and classification.
Register updated on every change: addition, removal or significant modification of an asset.
Full register review at least once every ▸ [12 months]min. 1×/year.
Register serves as input to the risk assessment process (DOC-002/003) and continuity planning (DOC-011).

Key IT/OT systems covered by the ISMS – organisation completes for each system

ID	System name	Type	Description / Function	Data classification	Criticality (1–5)	RTO	RPO	Business owner	IT Admin	Location	Update date
▸ SYS-001	▸ [e.g. Active Directory]	▸ [IT / OT / Cloud]	▸ [Identity and access management]	▸ [SECRET]	▸ 5	▸ [e.g. 1h]	▸ [e.g. 15 min]	▸ [First Last Name]	▸ [First Last Name]	▸ [Main server room]	▸ DD/MM/YYYY
▸ SYS-002	▸ [e.g. ERP / SAP system]	▸	▸	▸ [CONFIDENTIAL]	▸	▸	▸	▸	▸	▸	▸
▸ SYS-003	▸ [e.g. OT / SCADA system]	▸ OT	▸	▸ [SECRET]	▸ 5	▸	▸	▸	▸	▸	▸
▸ SYS-004	▸	▸	▸	▸	▸	▸	▸	▸	▸	▸	▸

ID	Dataset name	Description	Classification	Personal data (GDPR)	Location	Retention	Owner
▸ DAT-001	▸ [e.g. CRM customer data]	▸	▸ CONFIDENTIAL	▸ YES	▸ [database + backup]	▸ [X years]per GDPR / purposes	▸
▸ DAT-002	▸	▸	▸	▸	▸	▸	▸

List of accounts with administrative privileges – updated on every change. Access to register: CISO and IT Administrator only.

System	Account name	Permission type	Assigned to	MFA	Last review date
▸ [Active Directory]	▸ [Domain Administrator]	▸ [Domain Admin]	▸ [First Last Name]	▸ YES (FIDO2)	▸ DD/MM/YYYY
▸	▸	▸	▸	▸	▸

Version	Date	Author	Description	Approved by
▸ 1.0	▸	▸	▸ Initial release	▸ Board

DOC-020 Information Asset Register | v1.0 | NIS2/ISMS