Resource downloads
If you have any accessibility feedback or concerns related to this resource, please contact us.
What is an information asset register?
An information asset register (IAR) is an effective tool for information governance. It assists in understanding and identifying:
- high risk and high value areas of business;
- the systems, records, information, and data required to support these business areas;
- where records, information and data are stored and relevant business owner of the assets, and
- the high-level management of information assets throughout their use (from creation to usage, and finally to destruction or decommissioning).
An information asset refers to a group of records, information and data that is managed as a single unit. This register can be used by other branches within an organisation including ICT or cybersecurity.
Managing your information assets in a register enables identification of:
- all types of high risk/high value records held (in both physical and digital formats)
- the system or service environment where the records, information and data are held or stored
- what processes are in place to ensure the creation and capture of each type of record
- which business unit/business owner has responsibility for each system and the records, information, and data it holds
- information risks and their mitigation
- information security protections, including security classifications
- which records, information and data hold personal information
- metadata schema information
- access controls
- storage repositories/facilities/locations for each type of records, information, data, and
- retention and disposal requirements and disposal actions (i.e. destruction or transfer requirements).
Essentially the information asset register (IAR) is a list of all the records, information and data created and maintained by the organisation in one place regardless of format.
Why have an information asset register?
Your organisation may already use an information asset register to:
- gain a visibility of the information assets held organisation-wide and how to manage them
- identify vital systems and information assets for business continuity planning and cyber security
- provide evidence for meeting legislative and compliance requirements
- An information asset register provides compliance with minimum compliance requirements 2.2 and 2.3 of the Standard on records management.
- The register can be used as evidence for Q1, Q2, Q6, Q14, Q16, Q17, Q18, Q19 of the Records Management Assessment Tool (RMAT).
- identify the security of private or sensitive information assets
- identify information assets that hold personal information or are subject to privacy-impact assessments
- evaluate disposal practices of information assets
- decrease storage costs through disposal of redundant or duplicated information assets
- implement preservation strategies for information assets with long retention periods.
Creating an information asset register
An information asset register (IAR) should be established by considering the business requirements of the organisation, legislative and regulatory obligations, and how the register will be managed into the future. It is always better to start with small number of fields (known as metadata fields) and then expand over time.
An IAR doesn’t have to be held in a high-tech piece of software, especially when starting out, rather an excel document can be more than adequate to use as a register.
State Records NSW has provided a template for public agencies to use as a starter information asset register. See bottom of the page.
Design
Identify the core fields (i.e. metadata properties) that the register will need to capture. Use the information asset register template to help inform of suggested metadata properties. Core categories should cover:
- Description/Asset information
- Roles and responsibilities
- Security
- Public access and legislation
- Risks
- Disposal
- Management of information asset
| Tip: In order to cover all aspects of an information asset, it may be tempting to include additional metadata properties. However, this is only beneficial if it can be sustained over time. Start with core metadata fields and expand over time as resources allow. |
For further information on metadata see Mapping between AS/NZS 5478:2015 and the minimum metadata required and Minimum requirements for metadata for authoritative records and information
Scope
Identify the core business functions and activities, the critical services of the business and the related substantial information assets. This will assist in ensuring there are no gaps in the register.
Tip:
|
Identifying information assets
An asset is not usually a single item, rather a collection of information of a specific system, function or activity that is managed as a single unit with similar content, value, business risk and use. For example, a database of contracts, personnel files or all files associated with a certain project.
Group your information assets into manageable portions.
For example, your organisations EDRMS. It would be too granular to list every individual file in the EDRMS as an information asset but listing the EDRMS as a singular information asset may be too broad as the EDRMS would contain a large number of diverse types of records with a range of different sensitivities, value and disposal periods. In this example, it may be worth identifying different types of information assets using the categories in your organisation’s Business Classification Scheme (BCS) or different series of records which have been listed in the organisation’s Transfer Plan. It is important to find the balance of size for an information asset.
For each asset, it is important to note the following information which will help in grouping the assets:
- size and scope of the records and information held (and date range)
- size and scope of the system
- software and hardware critical for the maintenance of the asset
- any dependency on other records/information assets (including records generated using AI)
- format of the records (if paper, include volume and storage information; if digital, include title or name of the data set or file, description, modification date, license, and file format)
- business owner and users of the system
- security classification including if the asset contains personal or confidential information (including if there are DLMs or security classifications used)
- policies and processes that govern them, including statutory and regulatory obligations
- business value
- retention periods, including records required as State archives
- level of criticality of the business activities that the system supports (that is, how long can the organisation survive if the information asset was unavailable?)
Tip:
|
Review existing resources - identify information assets that have already been recognised by other business processes such as:
- cyber security attestation or information security planning (e.g. ‘Crown Jewels’ identification processes)
- business continuity and disaster recovery planning
- corporate risk management (risk registers and plans)
- responses to audit, inquiries or litigation
- information sharing agreements such as contracts or MOUs
- systems audit or IT asset inventory
- open data planning and reporting
- retention and disposal authorities
Engagement - Communication is essential to identifying the information assets that an organisation holds.
- talk to different business areas in your organisations (including ICT, data governance, cyber security etc.) to identify what records they create and hold
- work with your information technology business areas that may be aware of information assets that are not currently being used or have been decommissioned but are still held by the organisation such as legacy systems
Some basic questions to ask staff to help identify information assets:
- For process/activity X, what information do you collect or create as part of the process?
- What is it commonly called?
- Can you provide some details of what it covers?
- Why do you collect it?
- How long do you usually keep it for?
Further questions regarding the metadata can be expanded on after an information asset is first identified.
Reviewing and updating your information asset register
As the IAR is a directory of assets, access to an IAR should be accessible only authorised persons with the agency.
Since information assets are created or disposed of routinely, plan to regularly review the asset register to ensure information is correct. This could be through a yearly audit where the nominated custodian of each information asset is contacted to ensure that the information of the asset is still correct.
If any changes occur to an information asset, this should be reflected in the register.