Guest user Created: Aug 01, 2023 Last commented: Aug 03, 2023

Impact column in Asset Inventory

"In "09.07_Inventory_of_Assets_27001_EN.xlsx" there is a column (F) with Impact and there is a note saying "Copy from the Risk Assessment Table.". But, in the Risk Assessment Table, the Impact (which you call "Consequence") is for each Risk and not for the asset. Can you please clarify and explain if I am missing something?"

0 0

Assign topic to the user

Select user

Expert

Rhand Leal Aug 01, 2023

First of all, sorry for this confusion.

In case there are multiple risks related to an asset, then for the value of the impact to be included in the inventory of assets you need to use the highest consequence value related to the asset.

For example, in case you have three risks related to an asset called “server”, which respective consequence values of 1, 1, and 3, you need to include in the inventory of assets the value 3 for the column (F) impact.

This way your inventory of assets will keep the highest impact value identified.

Quote

0 0

Guest

Guy Aug 03, 2023

Thanks for your answer Rhand.
I don't see the benefit for us while there is also an Impact column in the risk spreadsheet.
Is this an ISO 27001 requirement? i.e., do we have to have this impact column in the inventory of asset?

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Aug 01, 2023

Aug 03, 2023

Expert Advice Community