I'm putting a list of assets together, but I'm really struggling to figure out how to categorise them.
Take for example you have the following:
- MailChimp (Full SaaS, holds potential PII in a database they manage)
- AWS (Shared responsibility, you build an EKS cluster, RDS postgres, cloudfront dist, and S3 buckets)
What sort of asset is MailChimp? On one hand, it's a Service asset, it's also a Vendor, but it's also a Data asset because you are potentially storing PII in your tenant data store on their servers.
EKS - It isn't a physical asset, the closest thing I can think of is a "Virtual Infrastructure" asset, RDS - again, this is infrastructure, but inside it, is a Data asset (the database that holds the actual data), S3 - same as RDS, both infrastructure and data asset..
Do these things spawn two assets? A service, or infrastructure + a data asset? Is S3, RDS and MailChimp all just Data assets?
Anyone successfully made heads or tails out of asset management from an ISO-27001/GDPR perspective?