Which standards require an asset management policy?

ISO/IEC 27001:2022: 5.9, 5.11; The NIS2 Directive: Art. 21(2)(i).

What must an asset management policy contain under ISO 27001?

5.9: Maintain a current asset inventory with owners. 5.11: Recover all organizational assets on exit or role change. The ISO 27002 guidance beside 5.9: Requires an inventory of information and of the other assets associated with it to be developed and kept current, and requires that inventory to record ownership of each entry.

Who should own the asset management policy?

The clauses imply the head of IT operations. The register names the role so the line on your list can carry a name.

How often should an asset management policy be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for an asset management policy?

Yes: https://compliance.theartofservice.com/policy-templates/asset-management-policy

Every policy type · Assets, data and classification

Asset management policy

What is held, who owns it, how it is recorded through its life and what the owner must do with it.

How the register reads it

Also called	asset register, asset inventory
Family	Assets, data and classification
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected owner	The head of IT operations.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	ISO 27001 or NIS2 is ticked and no line resolves to it.
Template	Asset management policy.

Which standards require it, and what each expects it to contain

3 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.9 Inventory of information and other associated assets

Maintain a current asset inventory with owners.

What the ISO 27002 guidance expects the document to say: Requires an inventory of information and of the other assets associated with it to be developed and kept current, and requires that inventory to record ownership of each entry.

Evidence an auditor accepts: The inventory of information and associated assets, showing scope across hardware, software, services, information stores and cloud tenancies; the recorded owner for each entry, and evidence owners have accepted the role; the process and cadence for keeping the inventory current, including additions and retirements
Common gap: Outdated entries in inventory
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 5.11 Return of assets

Recover all organizational assets on exit or role change.

What the ISO 27002 guidance expects the document to say: Requires personnel and other relevant interested parties to return all organisational assets in their possession when employment, a contract or an agreement changes or ends.

Evidence an auditor accepts: The leaver and role change procedure showing asset return as a mandatory step; the checklist or ticket used per departure, listing assets issued to that person from the inventory; signed confirmation of return, and records for assets not returned including the escalation taken
Common gap: Missing signatures on return forms
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

The NIS2 Directive

NIS2 Art. 21(2)(i) Human resources security, access control policies and asset management

Three linked disciplines sit in one point because they fail together. Human resources security covers screening proportionate to the role, security terms in employment, and the leaver process. Access control policy covers how identities are created, what rights they carry, how privileged access is granted and reviewed, and how rights change when a person moves internally. Asset management covers knowing what the entity has, who owns it, how it is classified and what happens at disposal. The join between them is where evidence is usually thin: a leaver process that reclaims the laptop but not the cloud account, or an access review run against a directory that does not include the systems that matter. Internal movers are a sharper test than leavers, because accumulated rights are rarely removed.

Evidence an auditor accepts: Screening policy and records proportionate to role sensitivity; joiner, mover and leaver procedure with timed evidence of access removal; access control policy plus periodic access review results, including privileged accounts
Common gap: Leaver process that covers directory accounts but not federated or cloud services
Source: NIS2 Directive

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Privileged access management policy · Data governance policy