Asset Management

PURPOSE

The purpose of this SOP is to ensure that all HIC’s assets are identified, recorded and managed in accordance with the ISO27001 standard.  

HIC categorises information assets as:   

• Infrastructure  

• Data  

• Service  

• End User Computing  

• Accounts and Projects  

SCOPE

The scope of this SOP extends to all HIC Teams, third parties, vendors and partner agencies who utilise or who are responsible for the development, management, and maintenance of HIC assets.  

RESPONSIBILITIES

PROCEDURE

Principles

1. Information Classification and Handling: All HIC information has a value to the organisation, however not all the information has an equal value or requires the same level of protection. Being able to identify the value of information assets is key to understanding the level of security that they require. HIC maintains an Information Classification and handling scheme which involves grouping information and categorising content to establish the most appropriate way of handling, storing, retrieving and to determine who is authorised to access Information.  

Steps

1. Inventory of Assets : Any assets which are of value to HIC needs to be identified and managed over its lifecycle. HIC are required to show how assets are managed and controlled, based around their importance.    

2. Ownership of Assets : All assets must have owners. Each owner is responsible for protecting the confidentiality, integrity, and availability of the information. Assets will have delegated staff who are responsible for the effective management of the asset during the asset lifecycle.  Owners will ensure:  

   • Assets are inventoried. 

   • Assets are correctly classified and protected. 

   • Access restrictions to the asset and its classification are periodically reviewed.  

   • Assets are handled correctly when being deleted or destroyed.  

3. Acceptable Use of Assets :HIC will refer to the University of Dundee Policy on Acceptable use   

4. Return of Assets :Upon termination of business relations, all users in possession or have access to information assets need to return them to HIC or have access removed by HIC.  

APPLICABLE REFERENCES

• Information Classification  

• For Definitions see ISMS Glossary

• Asset management policy - University of Dundee

• Acceptable use policy - University of Dundee

• Information Security Policy

DOCUMENT CONTROLS