Assets and information as assets

Domain 2 of the CISSP, Asset Security, asks a deceptively simple question: what does the organization have, how valuable is it, and how should it be handled from the day it is created or acquired until the day it is destroyed? Every other domain depends on the answer. You cannot design an architecture, write access rules, monitor a network or recover from an incident well if you do not know which assets matter most. This course works through the whole domain in twelve lessons, and this first lesson sets out what an asset is, why information deserves to be treated as an asset in its own right, how organizations build and maintain inventories, and how they decide what an asset is worth.

CISSP is a registered mark of ISC2. This course is an independent study aid based on the publicly available exam outline. The quiz and exam questions are original practice items written for this course; they are not real exam questions and are not taken from any exam.

Where Domain 2 sits

The CISSP exam outline in force since 15 April 2024 weights Domain 2 at about 10 percent of the exam, tied with software development security as the smallest domain. Small does not mean easy: asset security questions are often written as management scenarios in which the right answer depends on knowing who owns a decision, which law sets a minimum, or which sanitization method fits a piece of media. ISC2 reviews its outlines every few years through a job task analysis, and commentators have been discussing a possible future refresh, so check the ISC2 website before you sit the exam to confirm which outline applies. The 2024 outline divides Domain 2 into six sub-domains, which this course follows in order, spending more than one lesson on the larger ones.

What counts as an asset

In security, an asset is anything of value to the organization that needs protection. The obvious examples are tangible: servers, laptops, phones, network equipment, storage arrays, removable media, buildings, vehicles and industrial controllers. Less obvious, but often more valuable, are intangible assets: data and information, software and licenses, intellectual property such as designs and source code, customer relationships, brand and reputation, and the knowledge in people's heads. Services count too. A cloud tenancy, a software-as-a-service subscription, a domain name and a code-signing certificate are all assets whose loss or misuse would hurt.

People are sometimes described as assets in security writing, and in one sense they are the most valuable of all. The CISSP, however, treats people mainly through the lens of safety, roles and personnel security rather than as items in an asset register. When a question asks you to rank priorities, remember the rule from Domain 1: human safety always comes first.

Information deserves special attention because it behaves differently from physical assets. It can be copied perfectly at almost no cost, so theft may leave the original untouched and unnoticed. Its value can change quickly: a draft earnings report is extremely sensitive the day before release and public the day after. It moves constantly between systems, people, partners and clouds, so the place where it is stored today may not be where it is tomorrow. And the same piece of information can exist in many forms at once: a database row, a spreadsheet extract, a printed report, a screenshot in a chat, and a backup tape in an offsite vault. Asset security is largely about keeping track of information as it multiplies and moves.

Why inventory comes first

The first practical step in asset security is an inventory: a list of the assets the organization has, where they are, who is responsible for them and how important they are. Security frameworks put inventory at the very start for good reason. The Center for Internet Security's Critical Security Controls begin with inventory and control of enterprise assets, followed by inventory and control of software assets. NIST's Cybersecurity Framework 2.0 places asset management in the Identify function. ISO/IEC 27001:2022, through its Annex A controls, requires an inventory of information and other associated assets, with owners assigned. The logic is the same everywhere: you cannot protect what you do not know you have.

Unknown assets are a recurring theme in breach investigations. A forgotten test server still running an old operating system, a marketing team's cloud storage bucket set to public, an unmanaged laptop belonging to a contractor, or an internet-facing device that nobody remembers buying can each give an attacker a way in. These are often called shadow IT when business units acquire technology without involving IT or security. The cure is not to forbid every new tool, which simply drives the behavior underground, but to make registration easy and to discover assets actively.

A good inventory records, at minimum, a unique identifier, a description, the owner, the custodian or operator, the location, the classification of the information it holds or processes, its business criticality, and its life-cycle status. For hardware it adds the serial number, model and warranty or support dates; for software it adds the version, license terms and support end date; for data sets it adds the systems that hold them, the categories of personal information they contain and the retention rule that applies.

Building and maintaining the inventory

Inventories are built from several sources, because no single source sees everything. Procurement and finance records show what was bought. Network discovery scans and switch tables show what is connected. Endpoint management and mobile device management tools show which devices are enrolled. Cloud provider consoles and their application programming interfaces list virtual machines, storage, databases and identities. Identity systems show which applications people log into. Data discovery tools scan file shares, databases and cloud storage for sensitive content such as payment card numbers or health identifiers. Reconciling these sources is where the value lies: a device that appears on the network but not in the endpoint management console is either unmanaged or unauthorized, and either way needs attention.

Many organizations hold their inventory in a configuration management database (CMDB), part of an IT service management platform. A CMDB records configuration items, which can be hardware, software, services or documents, and the relationships between them, such as which application runs on which server and which business service depends on which application. These relationships matter for security. When a vulnerability is announced in a library, the CMDB can show which applications use it; when a server is compromised, it can show which services and data sets are affected.

Inventories decay quickly. Devices are added, moved, lent and lost; cloud resources are created and deleted in minutes; staff change roles. An inventory is therefore a process rather than a document. Automated discovery should run continuously or at least frequently, discrepancies should create tickets with owners and deadlines, and the inventory should be reviewed formally at set intervals and whenever there is a major change such as a merger, a data center move or a cloud migration.

Ownership and accountability

Every asset in the inventory needs an owner: a named person, usually a business manager rather than a technician, who is accountable for the asset's protection. The owner decides how sensitive the asset is, who should have access and what level of protection is appropriate, within the organization's policy. Owners rarely do the day-to-day work themselves. Custodians, often IT or operations teams, implement and operate the controls on the owner's behalf. Lesson 3 explores these roles in detail. For now, the key point is that an asset with no owner is an asset nobody will defend: no one approves access, no one notices when it is no longer needed, and no one decides when it should be retired.

Valuing assets

Security spending should be proportionate to the value of what it protects, so organizations need some way to value assets. Value can be measured in several ways, and a mature organization uses more than one. Replacement cost is what it would take to buy or rebuild the asset. Revenue or productivity dependence is how much income or work stops if the asset is unavailable. Liability exposure is the legal and regulatory cost of a breach, including notification, fines, lawsuits and remediation. Competitive value is the harm if a competitor obtained the asset, as with trade secrets. Reputational value is the effect on customer trust and the brand. Finally, there is value to an adversary: what the asset would be worth to a criminal, a competitor or a foreign intelligence service, which can be very different from its value to you.

Quantitative valuation assigns a monetary figure, which feeds directly into the asset value (AV) used in the single loss expectancy calculation from Domain 1: SLE = AV × EF, where EF is the exposure factor. Qualitative valuation assigns a rating such as low, moderate or high, or a score on a scale. Information is notoriously hard to value in money, so qualitative ratings tied to clear criteria are common, with quantitative estimates reserved for the most important assets or for business cases.

The example shows why the type of harm matters. The same database has a modest value when the question is whether it can be restored, and a large value when the question is whether it can be kept secret. This is one reason classification, covered in the next lesson, considers confidentiality, integrity and availability separately rather than giving each asset a single number.

Assets across their life cycle

Assets have a life cycle: they are planned, acquired or created, deployed, used and maintained, and eventually retired and disposed of. Information has a parallel life cycle, from creation or collection through storage, use, sharing and archiving to destruction. Security has a job at every stage. At acquisition, it sets requirements and checks suppliers. During use, it applies access control, monitoring and patching. At retirement, it ensures that data is retained where the law requires and destroyed securely where it does not, and that hardware leaves the organization only after sanitization. Lessons 5, 6, 8 and 9 follow these stages in detail, because some of the most expensive asset security failures happen at the end of the life cycle, when attention has moved on.

Thinking like a manager

CISSP questions on assets usually reward answers that start with knowledge and accountability before technology. If a scenario describes an incident involving an unknown server, the root cause is often a gap in inventory and ownership, not the missing patch itself. If a question asks what to do first in a new asset security program, building or validating the inventory and assigning owners is usually the right foundation. And if a question asks who decides how sensitive a data set is, the answer is the owner, not the custodian, the security team or the auditor. Keep these patterns in mind as you work through the rest of the domain.