You cannot protect what you have not listed, or protect it well if everything looks the same.

1. 5.9
   Inventory of information and other associated assetsKeep a current list of information and the things that hold or process it, each with an owner.
2. 5.10
   Acceptable use of information and other associated assetsWrite and share the rules for how people may use and handle them.
3. 5.11
   Return of assetsRecover company equipment and information when someone leaves or a contract ends.
4. 5.12
   Classification of informationSort information into levels by its sensitivity and importance.
5. 5.13
   Labelling of informationMark information so its level is visible to the people handling it.

The inventory covers more than laptops. It includes information assets (customer data, source code, contracts), the systems that hold them, the services you rely on, and the devices people use. Group them sensibly: one line per database is useful, one line per document is not.

• A named owner. A person accountable for the asset's protection and for approving access, not a team name.
• Classification. The level from your scheme, set by the owner.
• Location. Where it lives: a platform, region, office or device.
• Source of truth. The tool that keeps the line current, such as device management, the cloud console or the HR system.
• Link to risk. A reference to the risks that concern this asset.

Feed the inventory from systems that already know: device management for endpoints, the cloud account for infrastructure, the finance system for SaaS subscriptions. A hand-kept list drifts within months.

The standard does not prescribe levels. Most companies settle on three or four. More levels sound precise but leave people guessing, and a guess defeats the point. Each level needs plain examples and rules for storing, sharing and disposing.

When data of several levels sits together, the set takes the highest level. A spreadsheet with one column of customer health data is Restricted.

• Document templates with the level in the header or footer
• Sensitivity labels in the email and file platform, where it offers them
• Tags on cloud resources and databases recording their level
• A default rule: anything unlabelled is treated as Internal
• No physical labels needed for data that never leaves a system, if the system records the level

Acceptable use (5.10) ties it together: the policy tells people what each label means for them. Return of assets (5.11) closes the loop at exit, through the leaver checklist that HR and IT both sign.

1. The inventory lists what can be harmed.
2. Classification says how much harm exposure, alteration or loss would cause.
3. Owners judge threats and weaknesses for their assets with the security lead.
4. Risks for Confidential and Restricted assets are assessed first and in most depth.
5. Treatment choices go back to the asset line, so the auditor can trace both ways.

• The inventory, checked against a list the auditor draws from another source such as device management
• The classification standard and acceptable use policy, with staff acknowledgment
• A sample of documents or systems, checked for the right label or tag
• Leaver records showing devices and information returned

• Inventory with no owners. A list of things without accountable people does not meet 5.9.
• Too many levels. Six levels nobody can tell apart lead to everything marked Confidential.
• Rules without examples. "Sensitive data" with no examples leaves each person to decide.
• Labels only on paper. A scheme that ignores email, files and cloud storage misses most of the data.
• Leavers' devices untracked. No return record for a departed engineer's laptop is a finding under 5.11.

Sources: ISO/IEC 27001:2022 Annex A control names 5.9 to 5.13; ISO/IEC 27002:2022 as background (not quoted); clause 6.1.2 of ISO/IEC 27001:2022 on information security risk assessment, by title. The classification levels and examples are our own illustration.