Principle: A3 Asset management

Overview

This contributing outcome relates to you having an up to date and thorough understanding of your organisation’s assets, which includes all data and systems.

Identifying and documenting assets

All assets which are important to the operation of your essential function should be identified and documented. These include:

• information assets
• hardware assets
• software assets
• connected medical devices
• systems storing personal data
• systems storing business and commercial data

Information asset register

An information asset is a body of information, defined and managed as a single unit. This helps the organisation understand, share, protect and use it efficiently.

An information asset can vary in size and format. For example, it may be:

• a single document or a large dataset
• held electronically or on paper
• made up of personal data, non-personal data, or both

Identifying and inventorying information assets is done via your organisation’s information asset register. You should maintain an up to date information asset register documenting the information assets your organisation holds, where they are located, how long they will be retained for and who holds responsibility.

The template information assets and flows register produced by NHS England combines the information assets register with the record of processing activities (ROPA) into one document to reduce duplication. It contains all the categories of information that you should cover to uphold your legal data protection responsibilities, and therefore provides a useful reference point for your own internal information governance (IG) document templates and digital platforms that serve an information assets register/ROPA purpose.

Maintaining an up to date information assets and flows register gives you an important tool for understanding what data your organisation holds and processes. It helps you to assess and mitigate risks to this data and is invaluable in the event of an incident where data is compromised or unavailable.

Hardware, software, connected medical devices and other assets

For your hardware assets and the software on them, a survey tool will help you catalogue your estate in detail without having to undergo an intensive manual review. You should be aware of the limitations of your chosen tool(s), for example, survey tools may not be able to track installed software.

There is not a singular prescribed method for how assets should be documented. However, at a minimum, your inventory of assets should include details of each asset’s:

• type
• location
• software
• owner
• support and maintenance arrangements
• nature and quantity of data 
• criticality to the delivery of services

Connected medical devices

You should also have a way of cataloguing your organisation’s connected medical devices. You can expand an existing register or create a new bespoke register for this purpose, which should include the following details:

• all details you would include in your asset inventory
• vendor
• support and maintenance arrangements
• any network segmentation in place and whether network access is given to the supplier
• network name 
• internet protocol (IP) address (if static)

For connected medical devices holding personal data, it is likely that there will be some overlap between the asset inventory and your information assets and flows register. The registers you hold should ideally be linked or synchronised and enhanced with products such as asset discovery tools.

For more information on connected medical devices, see NHS England guidance on procuring and deploying connected medical devices, protecting connected medical devices, and network segmentation architecture patterns for connected medical devices. 

Managing assets with cyber security in mind 

You should have an asset management process which ensures that: 

• obsolete devices are identified and managed
• vulnerabilities identified across the sector are cross-referenced against the devices and software on your networks
• suitable controls are applied wherever assets are reused, transferred or disposed of (see B3.e Media/equipment sanitisation)

Assigning responsibility for managing assets

All assets should be assigned to an owner within the organisation who holds ultimate responsibility for managing them. 

The owner should understand:

• where the asset is stored
• what the asset is used for
• how access to the asset is controlled
• areas of potential risk for example, loss of personal data
• how the asset should be transferred or disposed of

NHS England has created training on becoming an information asset owner which you may find helpful for understanding the role, clarifying local responsibilities and supporting effective oversight of information assets. 

Supporting evidence

To support your response, you can upload (or link to) any evidence which best demonstrates your achievement of the contributing outcome. Examples include:

• the Information asset register  
• other document(s) or tool(s) for cataloguing assets 
• evidence of consideration and prioritisation of essential functions 
• evidence of asset dependencies on supporting infrastructure being recognised 
• evidence of asset managers and owners being assigned 
• procedures for reviewing and updating asset registers
• evidence of asset management procedures facilitating effective cyber security

This is not an exhaustive list. You can provide other types of evidence if you feel they are relevant to the contributing outcome.

Your supporting statement should cross-reference how each piece of evidence provides justification for your achievement of the contributing outcome, including relevant page numbers where appropriate.

Interpreting indicators of good practice

National services

The following national services may help your meet the requirements of A3.a Asset management:

• Security services | Cyber Assurance Service (CAS)
• Security services | Microsoft Defender for Endpoint (MDE)

Additional guidance

For additional guidance, see:

National Cyber Security Centre CAF guidance | A3 Asset management
National Cyber Security Centre | Asset management
NHS England | Cyber security guidance for healthcare professionals procuring and deploying connected medical devices 
NHS England | Guidance on protecting connected medical devices 
NHS England | Network segmentation architecture patterns for connected medical devices