Saas software, cloud services and ISO assets

Question

I'm putting a list of assets together, but I'm really struggling to figure out how to categorise them.

Take for example you have the following:

• MailChimp (Full SaaS, holds potential PII in a database they manage)
• AWS (Shared responsibility, you build an EKS cluster, RDS postgres, cloudfront dist, and S3 buckets)

What sort of asset is MailChimp? On one hand, it's a Service asset, it's also a Vendor, but it's also a Data asset because you are potentially storing PII in your tenant data store on their servers.

EKS - It isn't a physical asset, the closest thing I can think of is a "Virtual Infrastructure" asset, RDS - again, this is infrastructure, but inside it, is a Data asset (the database that holds the actual data), S3 - same as RDS, both infrastructure and data asset..

Do these things spawn two assets? A service, or infrastructure + a data asset? Is S3, RDS and MailChimp all just Data assets?

Anyone successfully made heads or tails out of asset management from an ISO-27001/GDPR perspective?

Answer 1

MailChimp is a vendor. They are a company.

The customer database MailChimp stores and processes is the asset.

MailChimp also provides an email-sending service. That's a service asset which is the primary service of the vendor.

You could port your customer database to another vendor or bring in-house. That's how you can define the differences between the assets.

So, now you can take that model to look at AWS. EKS, RDS, S3, etc. are all tightly coupled in a way that is difficult or doesn't make sense to separate the different parts to have different vendors, or yourself, to process. So, you can make "logical groupings" of these different products into a coherent data asset.

Think of it like a physical database server: the database is an asset, that sits on a physical server, served with power, etc. You don't break down the database into the different platters in the disks as separate assets. You make logical groupings and take a step up the asset taxonomy. Do the some thing, where it makes sense, with cloud services.