Which of the following does an Asset Register contain? (Choose two)

An asset register, or inventory of assets, is a foundational requirement for an Information Security Management System (ISMS) compliant with ISO/IEC 27001. Its purpose is to identify all information assets to manage and protect them effectively. According to the implementation guidance in ISO/IEC 27002, the inventory should record key attributes for each asset. This includes the Asset Type (e.g., hardware, software, information, service) to understand its nature, and the Asset Owner, who is the individual or entity assigned responsibility for the asset's lifecycle, classification, and protection. These two elements are critical for accountability and applying appropriate security controls.

C. Asset Modifier: This is not a standard attribute. While change logs are important, the person who last modified the register entry is metadata, not a core property of the asset itself.

D. Process ID: A Process ID (PID) is a temporary, system-level identifier for a running software process and is not a static attribute recorded in a high-level asset management register.

1. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls.

Section 5.9, Inventory of information and other associated assets: The implementation guidance for this control states, "The inventory of information and other associated assets should be accurate, up to date, consistent and maintained... The inventory should include the following information as appropriate: ... owner; type of asset...". This directly confirms that Asset Owner and Asset Type are required components.

2. von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102.

Page 100, Section 3.2: In discussing the evolution of ISMS based on ISO 27001, the authors emphasize the foundational step of asset management: "The first major step in this process is to create an asset register... For every asset, an owner must be specified...". This academic publication reinforces the critical role of identifying assets and their owners.

DOI: https://doi.org/10.1016/j.cose.2013.04.004

3. University of London, Courseware for IN3040 Information Security Management.

Topic 4: Risk Management, Lecture Notes: The course materials explain that a comprehensive asset register is the starting point for risk assessment. The notes specify that the register should contain, at a minimum, "a description of the asset, its owner, its location, and its value/classification." The description inherently includes the asset's type.