{"id":41,"date":"2022-04-12T01:36:24","date_gmt":"2022-04-12T01:36:24","guid":{"rendered":"http:\/\/tcm.gov.to\/?page_id=41"},"modified":"2022-04-28T20:27:27","modified_gmt":"2022-04-28T20:27:27","slug":"it-asset-inventory","status":"publish","type":"page","link":"https:\/\/tcm.gov.to\/?page_id=41","title":{"rendered":"IT Asset Inventory"},"content":{"rendered":"
\n \t\n\t
\n\t \t
\n\t\t\t
\n\t \t \t
\n\t\t \n
\n
\n

IT Asset Inventory<\/h1> <\/div>\n<\/div>\n\n\n
\n
\n

Information assets are something an organization needs to keep their information system running. These assets typically consist of more than just hardware and software, including data, network, personnel, site, and the organization\u2019s structure.<\/p>\n

Asset identification should be performed at a level of detail that provides sufficient information for risk assessment. An asset owner should be identified for each information asset, to provide responsibility and accountability for the asset. The asset owner is often the most suitable person to determine the asset\u2019s value to the organization.<\/p>\n

As a next step, requirements of confidentiality, integrity and availability should be assigned to systems and data. Data should be classified in terms of legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification.<\/p>\n

Make sure that classifications and associated protective controls for information takes account of business needs for sharing or restricting information, as well as legal requirements.<\/p>\n

Develop a classification scheme that includes conventions for classification and criteria for review of the classification over time. Make sure that the scheme is consistent across the whole organization so that everyone will classify information and related assets in the same way, have a common understanding of protection requirements and apply the appropriate protection.<\/p>\n

Verify that the results of classification indicate value of assets depending on their sensitivity and criticality to the organization, e.g. in terms of confidentiality, integrity and availability.<\/p>\n

Classification provides people who deal with information with a concise indication of how to handle and protect it. Creating groups of information with similar protection needs and specifying information security procedures that apply to all the information in each group facilitates this. This approach reduces the need for case-by-case risk assessment and custom design of controls.<\/p>\n

An example of an information confidentiality classification scheme could be based on four levels as follows:<\/p>\n

a) disclosure causes no harm;<\/p>\n

b) disclosure causes minor embarrassment or minor operational inconvenience;<\/p>\n

c) disclosure has a significant short term impact on operations or tactical objectives;<\/p>\n

d) disclosure has a serious impact on long term strategic objectives or puts the survival of the organization at risk.<\/p>\n

Similar classification levels could be defined for integrity and availability.<\/p> <\/div>\n<\/div>\n\n\t <\/div>\n\t \t<\/div>\n\t\t <\/div>\n\t \n\t<\/div>\n\t\n\t<\/div>\n\n\n","protected":false},"excerpt":{"rendered":"

IT Asset Inventory Information assets are something an organization needs to keep their information system running. These assets typically consist of more than just hardware and software, including data, network, personnel, site, and the organization\u2019s structure. Asset identification should be performed at a level of detail that provides sufficient information for risk assessment. An asset […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-41","page","type-page","status-publish","hentry","has-post-title","has-post-date","has-post-category","has-post-tag","has-post-comment","has-post-author",""],"builder_content":"

IT Asset Inventory<\/h1>\n

Information assets are something an organization needs to keep their information system running. These assets typically consist of more than just hardware and software, including data, network, personnel, site, and the organization\u2019s structure.<\/p>

Asset identification should be performed at a level of detail that provides sufficient information for risk assessment. An asset owner should be identified for each information asset, to provide responsibility and accountability for the asset. The asset owner is often the most suitable person to determine the asset\u2019s value to the organization.<\/p>

As a next step, requirements of confidentiality, integrity and availability should be assigned to systems and data. Data should be classified in terms of legal requirements, value, criticality and sensitivity to unauthorized disclosure or modification.<\/p>

Make sure that classifications and associated protective controls for information takes account of business needs for sharing or restricting information, as well as legal requirements.<\/p>

Develop a classification scheme that includes conventions for classification and criteria for review of the classification over time. Make sure that the scheme is consistent across the whole organization so that everyone will classify information and related assets in the same way, have a common understanding of protection requirements and apply the appropriate protection.<\/p>

Verify that the results of classification indicate value of assets depending on their sensitivity and criticality to the organization, e.g. in terms of confidentiality, integrity and availability.<\/p>

Classification provides people who deal with information with a concise indication of how to handle and protect it. Creating groups of information with similar protection needs and specifying information security procedures that apply to all the information in each group facilitates this. This approach reduces the need for case-by-case risk assessment and custom design of controls.<\/p>

An example of an information confidentiality classification scheme could be based on four levels as follows:<\/p>

a) disclosure causes no harm;<\/p>

b) disclosure causes minor embarrassment or minor operational inconvenience;<\/p>

c) disclosure has a significant short term impact on operations or tactical objectives;<\/p>

d) disclosure has a serious impact on long term strategic objectives or puts the survival of the organization at risk.<\/p>

Similar classification levels could be defined for integrity and availability.<\/p>","_links":{"self":[{"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/pages\/41","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tcm.gov.to\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=41"}],"version-history":[{"count":10,"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/pages\/41\/revisions"}],"predecessor-version":[{"id":212,"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/pages\/41\/revisions\/212"}],"wp:attachment":[{"href":"https:\/\/tcm.gov.to\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}