[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-9":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-9","Annex A 5.9","ISO\u002FIEC 27001:2022 Annex A 5.9: Inventory of information and other associated assets",1,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects an inventory of information and other associated assets, including owners, to be developed and maintained. Its purpose is to identify the organisation's information and assets so that their security can be preserved and ownership assigned.\n\n**In practice.** Good practice means an inventory that covers information, hardware, software, cloud services and other relevant assets, with owners responsible for protection. Automated discovery helps keep it accurate, and it is linked to classification, risk assessment and vulnerability management. Auditors expect the inventory, evidence that owners are assigned and records showing it is kept up to date.\n\n**Common gaps.** Common gaps are inventories that cover devices but not information or cloud services, stale records and owners who do not know they are owners. Assets held by suppliers on the organisation's behalf are often missing.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"piaggio-fined-460k-for-unlawful-employee-email-monitoring-and-delayed-account-deactivation","Piaggio Fined €460K for Unlawful Employee Email Monitoring and Delayed Account Deactivation","2026-08-06T10:20:40.321+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",{"slug":28,"name":29,"problem":30,"stories":9},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":32,"name":33,"problem":34,"stories":9},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[36,41,45,50,53,57,61,65],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","3","Control 3","Data Protection",{"family":37,"item":42,"code":43,"title":44,"together":9},"5","Control 5","Account Management",{"family":46,"item":47,"code":48,"title":49,"together":9},"gdpr","35","Article 35","Data protection impact assessment",{"family":46,"item":42,"code":51,"title":52,"together":9},"Article 5(1)(f)","Principles relating to processing of personal data",{"family":46,"item":54,"code":55,"title":56,"together":9},"6","Article 6","Lawfulness of processing",{"family":46,"item":58,"code":59,"title":60,"together":9},"88","Article 88","Processing in the context of employment",{"family":5,"item":62,"code":63,"title":64,"together":9},"a-6-5","Annex A 6.5","Responsibilities after termination or change of employment",{"family":66,"item":67,"code":68,"title":68,"together":9},"itil","overview","ITIL"]