What Is an Information Asset Register?

An information asset register records what information an organization handles, where it is kept, who is accountable for it, how important it is, and how it should be protected.

It provides a foundation for assessing disclosure, alteration, loss, and unavailability risks. For system designers, it helps turn business needs into requirements for access control, backups, logging, retention, and deletion.

This article draws on Appendix 6 of Japan’s Information-technology Promotion Agency (IPA) Information Security Guidelines for Small and Medium-sized Enterprises, Version 4.0, and the supplied Excel workbook. Additional fields and operating practices are recommendations in this article. The approach is useful internationally, but local legal and contractual requirements must be determined separately. This article is an explanatory adaptation, not an official IPA translation.

What Is an Information Asset?

Information assets are valuable information and the resources that support it. They include electronic records, paper documents, and technical knowledge.

Some organizations use the term broadly enough to include systems and equipment. For practical register design, this article distinguishes the information being protected from the IT assets that store, process, or transmit it.

Type of information	Examples	Protection priorities
Customer and supplier records	Contact details, identity documents	Restricted access and disclosure prevention
Personnel records	Payroll, employee details, health records	Limited access and controlled retention
Contracts and financial records	Agreements, invoices, accounting data	Accuracy, evidence, and preservation
Operational and transaction data	Orders, trades, balances, payments	Integrity, availability, and recovery
Technical information	Source code, designs, research data	Confidentiality, change control, and backups
Published information	Websites and product catalogs	Accuracy, protection against alteration, and availability
Operational and authentication information	Audit logs, configurations, keys, credentials	Access control, evidence preservation, and secure storage

Public information still needs protection: altered product information or an unavailable website can cause harm even when confidentiality is unimportant.

Why Manage Information Assets?

You cannot reliably protect information or assess an incident’s impact without knowing where it exists. Copies may be held in email, employee devices, cloud services, paper archives, backups, and supplier systems.

Purpose	What the register helps establish
Identify the protection scope	Where information and its copies are held
Assign accountability	Who approves use, sharing, deletion, and risk acceptance
Prioritize controls	Which risks deserve limited time and budget first
Support compliance	Which records need particular handling or retention rules
Respond to incidents	Which information, business teams, and contacts are affected
Manage migration and disposal	What must be transferred, preserved, or deleted when a service ends

The register is useful only when its findings lead to controls, reviews, and changes. Completing a spreadsheet alone does not make information secure.

Information Asset Register vs. IT Asset Inventory vs. Asset Register

Terminology varies between organizations. Define each register’s scope and purpose rather than relying on its name.

Register	Primary scope	Purpose	Typical entries
Information asset register	Data, documents, and business information	Protection, criticality assessment, and risk analysis	Customer records, owner, location, confidentiality/integrity/availability
IT asset inventory or register	Devices, software, cloud services, connectivity	Configuration, usage, contracts, lifecycle, and security management	Laptops, operating systems, subscriptions, support expiry
Asset register	Assets within an organization-defined scope	Management according to that scope	May mean an IT register or a broader equipment register
Fixed asset register	Assets tracked for accounting purposes	Acquisition cost, depreciation, and disposal	Purchase date, book value, useful life

IPA calls Appendix 6 an “asset management register,” but it is a security workbook containing information, network equipment, software, and hardware registers, together with risk-scoring worksheets. It is not simply an accounting register.

What an IT Asset Inventory Covers

Category	Examples	Useful fields
Hardware	Laptops, servers, phones, storage	Asset ID, serial number, user, location, support expiry
Software and licenses	Operating systems, middleware, applications, subscriptions	Version, installation, entitlement, usage, renewal and support dates
Cloud services	SaaS, IaaS, PaaS	Tenant/account, administrator, purpose, contract, region, exit arrangements
Communications and connectivity	Routers, firewalls, circuits, VPNs, domains, DNS	Configuration, connections, exposure, owner, contract and renewal dates

Distinguish service-level contracts and tenants from individual technical resources. Rapidly changing cloud resources are better discovered automatically than manually copied into spreadsheets.

Link Information to the IT Assets That Support It

“Customer records” are an information asset; “customer management SaaS” is an IT asset. Linking their IDs makes service failures, supplier changes, and contract termination easier to assess.

Information asset ID	Information asset	Related IT asset ID	Location or purpose
INFO-001	Customer records	IT-010	Production customer management SaaS
INFO-001	Customer records	IT-020	Backup storage
INFO-002	Contract documents	IT-010	Contracts stored in the same SaaS

The relationship is many-to-many. Use separate rows or linked detail records when copies have different media, permissions, criticality, or risks.

Fields to Include in an Information Asset Register

Core Fields in the Supplied IPA Sample

Field	What to record
Business category	The process or department using the information
Information asset name	A clear name, such as employee register or customer records
Notes	Contents, boundaries, or other clarifications
Authorized users	Permitted departments or roles
Responsible department	The team accountable for management
Responsible manager	The person with information-security management responsibility
Manager contact details	A usable operational or incident contact
Medium and storage location	Paper, device, server, removable media, external server, etc.
Confidentiality, integrity, availability ratings	Separate ratings from 1 to 3
Criticality	The highest of the three ratings; calculated in the sample
Retention deadline	How long to retain the information and when to dispose of it
Registration date	The sample instructions say to replace this with the update date when revised

Set retention according to the record type, applicable jurisdiction, contracts, and business needs. Do not copy Japanese sample retention periods into another organization without checking applicability. Record the start event, such as contract termination, as well as the duration.

Recommended Additional Fields

These are practical additions, not a claim that all are dedicated columns in IPA’s information asset worksheet.

Field	Purpose or example
Information and related IT asset IDs	Stable references across registers
Information classification	Public, internal, confidential, with defined handling rules
Sensitive information categories	Personal data, health data, credentials, trade secrets; use relevant local definitions
Purpose and recipients	Why information is used and with whom it is shared
Detailed location	System, folder, tenant, account, region, and supplier
Access and sharing rules	Permitted roles, external sharing, access review process
Controls and evidence	Encryption, MFA, backups, logs, configuration checks
Recovery requirements	Acceptable downtime, acceptable data loss, restore-test results
Retention and deletion rules	Basis, start event, disposal method, backup treatment
Risk references	Risk IDs, assessment rationale, treatment plans
Review history	Creation, update, verification, and next review dates

Never record actual passwords, private keys, or API secrets in the register. Record the secure storage reference and accountable owner instead.

Choose a Sustainable Level of Detail

Group records that share a business purpose, management arrangements, and criticality. You rarely need an entry for every individual file.

Separate paper originals from electronic copies when their risks differ. The supplied IPA workbook explicitly recommends separate rows for paper and electronic storage. Include backups, test copies, and supplier-held copies in the assessment scope.

How to Use the Register for Risk Assessment

The following method explains the supplied IPA sample and adds the steps needed to turn an assessment into action.

1. Identify Information Through Business Processes

For each process, follow information through collection or creation, use, sharing, storage, and disposal. Interview business staff and verify systems, contracts, and physical storage locations.

Start with sensitive information and information whose loss would seriously disrupt operations, document gaps, and expand coverage. Automatic device discovery cannot determine the meaning or business importance of records, or discover all paper documents.

2. Assess Confidentiality, Integrity, and Availability

Dimension	Question	Resulting control requirements
Confidentiality (C)	What happens if unauthorized people obtain the information?	Access restrictions, encryption, sharing controls
Integrity (I)	What happens if information is altered, incomplete, or incorrectly updated?	Approval, change history, reconciliation, tamper detection
Availability (A)	What happens if authorized users cannot access it when needed?	Redundancy, backups, recovery procedures

The supplied sample assigns each dimension a rating from 1 to 3:

Criticality = MAX(confidentiality, integrity, availability)

Use a documented rating policy consistently and retain the reasoning. IPA’s definitions include Japanese legal considerations for certain confidentiality and integrity ratings. International users should adapt these to their own obligations and business impacts.

3. Identify Threats and Weaknesses

A threat is a cause or event that could create harm. A vulnerability is a weakness that could allow that harm. Weaknesses include poor procedures and configurations, not only software defects.

Asset and storage form	Example threat	Example weakness
Cloud customer records	Unauthorized access or accidental publication	Excessive privileges, public links, insufficient authentication
Business data on a laptop	Ransomware or device loss	Missing updates, insufficient encryption, inadequate recoverable backups
Paper contracts	Loss, unauthorized removal, fire	Inadequate locking, checkout controls, or alternative preservation
Transaction records	Incorrect updates, tampering, outages	Missing approval, reconciliation, change history, or recovery procedures

Verify controls with evidence. “Backups enabled” is insufficient without checking coverage, isolation, and restoration results.

4. Calculate Risk Using the IPA Sample Method

The sample uses two ratings. Threat frequency is assessed assuming protective measures are absent; the vulnerability rating reflects the implementation of relevant controls.

Rating	Threat frequency	Vulnerability / control implementation
1	Very unlikely under normal conditions	Necessary controls are adequately implemented
2	Could occur under particular conditions	Controls are partial or insufficient
3	Could occur during ordinary operations	Controls are absent, or implementation is unknown

The supplied Excel formulas calculate a harm-likelihood rating as follows:

Harm likelihood = ROUND UP [threat frequency ÷ (4 − vulnerability)]

Round up to the next integer. These numbers are ordinal ratings for prioritization, not percentage probabilities.

Threat frequency	Vulnerability 1	Vulnerability 2	Vulnerability 3
1	1	1	1
2	1	1	2
3	1	2	3

Risk score = criticality × harm likelihood

Risk score	Sample classification
6 or 9	High
4	Medium
1, 2, or 3	Low

Scores of 5, 7, and 8 cannot occur because both factors range from 1 to 3. This method does not simply multiply criticality, threat, and vulnerability together. It is a simplified method in this particular workbook, not a universal requirement for risk assessment.

In the supplied risk-scoring worksheet, populate or copy the matching asset details and enter the ratings. Do not assume all asset data is automatically linked from the register. Check row alignment and formula coverage. Editing the example register alone does not perform the analysis.

5. Treat Risks and Review Residual Risk

This is an illustrative assessment, not a prescribed score for every cloud service.

Item	Before treatment	After controls are implemented and verified
Asset	Cloud customer records	Same asset
C / I / A; criticality	3 / 3 / 2; 3	3 / 3 / 2; 3
Threat frequency	3	3
Vulnerability	3: inadequate sharing, access, and authentication controls	1: all controls necessary for the assessed scope are verified
Harm likelihood	3	1
Risk score	9: high	3: low

Possible actions include restricting sharing, removing excessive permissions, enabling MFA, and reviewing access logs. The information remains important after controls improve. A lower score does not guarantee that an incident cannot occur.

Consider severe consequences, mandatory requirements, and uncertainty alongside the numerical score. Do not omit necessary controls simply because the result is classified as low.

Record the risk ID, treatment, accountable person, deadline, completion evidence, reassessment, and residual-risk approver. Options include avoiding the activity, reducing risk with controls, sharing or transferring some consequences through contracts or insurance, and explicitly accepting risk through an authorized decision. Outsourcing does not remove all responsibility or risk.

Keep the Register Current

Update entries when services are introduced or retired, locations or permissions change, suppliers change, or information is deleted. Add periodic reviews based on risk—for example, every six or twelve months. These intervals are suggestions in this article, not a universal IPA requirement.

Business owners verify content, purpose, and impact. IT staff verify locations, dependencies, and technical controls. Security staff maintain assessment consistency and check evidence. An authorized accountable person decides whether residual risks are acceptable. Small organizations may combine these roles but should still document accountability.

Protect the register itself: it contains sensitive locations, contacts, and security details. Restrict viewing and editing, preserve change history, and maintain backups. Combine automatic IT inventory collection with business-owner judgments rather than expecting either one to provide the complete picture.

References

IPA fields and calculations above are based on Appendix 6 and the supplied workbook. Additional fields, scenarios, and operating practices are this article’s recommendations. The Japanese source workbook is not an English template.