We've started implementing ISMS in our organization. The scope is IT dept and all users of the company who are connected to our WAN. but our risk assessment scope is only Data center and Network infrastructure and we are told to consider only critical assets of this scope for first implementation.

Now I want to know:

  1. Is it acceptable to consider only critical assets not all of them?

  2. With what parameters we choose critical assets?

  3. Are core processes in this scope one of our critical assets or only information that is used and generated in these processes should be considered as assets?

  4. Is this a correct view for what I explained: for defined risk assessment scope which is defined under our ISMS scope, we consider our core and distributed switches and routers, critical network connections between them, our servers which are VMs and their hardware (SANs, Storages, Blades), and what else?

  • who has told you to only consider critical assets? Management? Auditors? ISO 27k consultants?
    – schroeder
    Feb 12, 2015 at 23:20

3 Answers 3


Hmmm. I think I am slightly concerned about the way in which your company is thinking about what's on what side of the critical vs. less-than-critical line here. Because (from the way you put it) it appears that it's taking a very sort-of supposedly "traditionalist', tangible equipment-centric, location-centric approach to determining what is and is not critical in terms of risk potential. And, in my view, (yes, a slight touch of opinion leaking in here, maybe) that's a tendency you want to correct early on.

There are really two types of things* you need to protect in the critical category: critical information, and critical systems. To put it briefly but clumsily, the thing about critical information is that information doesn't just exist or move to "where it is supposed to be". There's no way you can just say "All critical information anywhere in our networks, get into our datacenter, now!" and have it work. You have to go out and find vital information/data that is hugely important and that your company absolutely must protect. You have to go out to where it's created inside your company or where it comes into your company and see where that is. You need to see whom it flows to and to where. And then see where it eventually winds up and is stored (likely that datacenter, finally.) And then, once you determine what the critical information really is and where it is and where it flows then you can start to do risk assessment and all the other fun bureaucratic planning and such.

But first you need to go out in the field and figure out where the critical info actually is. Not just say assess stuff at Location X first because Well, the important stuff is theoretically supposed to be there, and therefore it is all there. (And that's particularly not a great approach to take in this era of ubiquitous smartphone use and ever increasing cloud usage, sometimes with pre-approval from centralized management and sometimes without.)

As for critical systems, I think much of the same analysis holds. Looking after risks related to the expensive servers and networking equipment in your datacenter is certainly a good & necessary thing to do, but a reasonable person might conclude that looking at the risks relevant to the smartphones your company's R & D executives carry around everyday are even more deserving of being labeled "critical".

Anyway, my two cents. Cheers.

  • Ugh. Why did I just answer a question that's 10 months old like it was 10 minutes old? Dumb "active" questions list. Nov 10, 2015 at 5:21
  • I'm personally glad you answered the question since the organization i work for is undergoing the process of implementing information security. The biggest challenge is quantifying the criticality of a given asset especially when it hasn't been traditionally thought of. For example, you may deem x documents to be critical because leakage or the unavailability of them has financial and operational impact. The issues arises in defining the extent of the leakage or unavailability. For example, will it result in losses in the millions or result in the inability to deliver products.
    – Motivated
    Nov 10, 2015 at 7:00
  • Assuming you can "thumbsuck" your way through i.e. it'll cost $x dollars, or slightly more intangible such as it'll wreak havoc on our brand, etc, the next set of challenges in where is this information stored, accessed, transported, etc and this is exacerbated should this result in additional "investment" to secure the information be it equipment, processes, policies, etc. Since security is generally since as yet another cost center, it's dropped quickly as there isn't an awareness of it value. Now what if the information resides on shared services e.g. network, storage, etc?
    – Motivated
    Nov 10, 2015 at 7:05
  1. For the beginning of this process, starting with the critical assets makes sense. To eat a dinosaur, you have to cut it up into bits. Makes it easier to cook and swallow. Eventually you'll want to have everything under the ISMS umbrella, or at least try your best to get everything.

  2. That's up to you. What systems can your business not live without? What holds personal data that would be harmful in the wrong hands? What are the systems that form the backbone of your business?

  3. An asset is something that is valuable and useful. The processes may be more valuable than the data, or vice versus depending on your infrastructure. What do they mean to your business?

  4. Not too sure what you're asking there. That's a good start and it makes sense with what you said above.

  • thanks for ur answer. i wanted to know if the risk assessment scope is Data center and network infrastructure, are information systems involved in our assets for risk assessment? or just network devices and dc?and one more thing, how many assets we should consider in first round? is there any recommended number?
    – sarv
    Feb 12, 2015 at 6:59

My first reservation would be that you have one scope for your ISMS, and a smaller scope for your risk assessment. In that case your ISMS only really covers the smaller scope. If you (the business) are OK with the smaller scope, just say that's all you'll cover in the ISMS.

Is it acceptable to consider only critical assets? The problem is that you might find that some assets that you think aren't critical are in fact critical. It might be better to initially try and identify all assets.

How do you decide what's critical? You determine your own asset valuation criteria, typically how the impact of a loss of confidentiality, integrity or availability would affect the business. Then perform a valuation of each asset, based on your criteria.

Are core processes an asset? Yes they are. ISO 27005 calls them primary assets, with the things you typically think of as assets being called supporting assets. I always find this a bit strange though, because you'll typically assess risk in terms of secondary assets. If you think about the non-availability of a core process though, it'll almost certainly be critical to the business.

For the list of items you have in your example, I would expect all those assets to be in your risk assessment. Ultimately you will know better than me what's in your business, but things I don't see are: software; internet connectivity; power supply; building; people.

  • Out of curiosity, how this work with shared services?
    – Motivated
    Nov 10, 2015 at 6:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .