AI ITAM Platform
IT Asset Management Software: The Features That Matter
An asset register in Excel answers “what do we have?” badly and “who approved that change?” not at all. Here is what an ITAM platform must add.
Key takeaways
- A.5.9 requires an inventory with owners.
- Classification and labelling follow the information’s value.
- Return and disposal need evidence, not just policy.
- Endpoint devices have their own control in the 2022 edition.
Controls and evidence
| Control | Requirement in brief | Evidence auditors look for |
|---|---|---|
| A.5.9 | Inventory of information and other associated assets, including owners | Current register with owners |
| A.5.10 | Acceptable use of information and assets | Policy and user acknowledgements |
| A.5.11 | Return of assets | Leaver records showing returns |
| A.5.12 | Classification of information | Classification scheme and classified assets |
| A.5.13 | Labelling of information | Labelling procedure and examples |
| A.7.14 | Secure disposal or re-use of equipment | Sanitization records and certificates |
| A.8.1 | User endpoint devices | Endpoint register, configuration and protection |
Common nonconformities
- Inventory incomplete or out of date
- Assets without owners
- No evidence of returns from leavers
- Disposals without sanitization records
- Classification defined but not applied
Making it sustainable
Policies alone do not pass audits. Run the controls through a system: mandatory owner and classification fields, leaver-triggered return requests, disposal blocked until sanitization is recorded, and periodic verification that the register matches reality.
Preparing for the audit
- Export the current register with owners and classification.
- Prepare samples of allocations, returns and disposals with approvals.
- Show disposal certificates for retired media.
- Show the latest verification audit and actions.
- Map each control to evidence in your statement of applicability.
Related controls
Asset data also supports vulnerability management (A.8.8), configuration management (A.8.9), information deletion (A.8.10) and supplier controls (A.5.19 to A.5.23). One accurate register reduces evidence work across all of them.
Scope and depth
The standard does not require every cable to be inventoried. Define what counts as an asset in your scope — information, software, hardware, services and people with key knowledge — and the level of detail needed. Auditors look for a reasoned scope applied consistently, an owner for every significant asset, and evidence that the inventory is kept current rather than produced once for the audit.
How NAZZTEC helps
NAZZTEC AI ITAM automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises. Our consultants design and run the process alongside it through our Governance, Risk & Compliance services.
Next step: request a demo of NAZZTEC AI ITAM or read more on the product page.
Frequently asked questions
Do we need to inventory information as well as hardware?
Yes — A.5.9 covers information and other associated assets, including software and services.
What is an asset owner?
The person or role accountable for the asset’s protection throughout its lifecycle.
How often should the inventory be reviewed?
Continuously through lifecycle workflows, with periodic verification at least annually.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
