What must a software asset management policy contain under ISO 27001?

5.9: Maintain a current asset inventory with owners. 8.19: Securely manage software installation on production systems. The ISO 27002 guidance beside 5.9: Requires an inventory of information and of the other assets associated with it to be developed and kept current, and requires that inventory to record ownership of each entry.

Who should own the software asset management policy?

The clauses imply the head of IT operations. The register names the role so the line on your list can carry a name.

How often should a software asset management policy be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a software asset management policy?

Yes: https://compliance.theartofservice.com/policy-templates/software-asset-management-policy

Every policy type · Assets, data and classification

Software asset management policy

Which software may be installed, by whom, under which licences, and how the installed estate is inventoried.

How the register reads it

Also called	software inventory, approved software list
Family	Assets, data and classification
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the asset management policy; when neither is listed, the gap is counted once, under the parent.
Expected owner	The head of IT operations.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, asset management policy, is).
Template	Software asset management policy.

Which standards require it, and what each expects it to contain

2 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.9 Inventory of information and other associated assets

Maintain a current asset inventory with owners.

What the ISO 27002 guidance expects the document to say: Requires an inventory of information and of the other assets associated with it to be developed and kept current, and requires that inventory to record ownership of each entry.

Evidence an auditor accepts: The inventory of information and associated assets, showing scope across hardware, software, services, information stores and cloud tenancies; the recorded owner for each entry, and evidence owners have accepted the role; the process and cadence for keeping the inventory current, including additions and retirements
Common gap: Outdated entries in inventory
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 8.19 Installation of software on operational systems

Securely manage software installation on production systems.

What the ISO 27002 guidance expects the document to say: Requires procedures and measures to be implemented to manage software installation on operational systems securely. Secondary commentary notes that this replaces a narrower restriction on software installation and is oriented to remote working and mobile devices.

Evidence an auditor accepts: Procedures governing installation of software on operational systems, including who may install and under what authorisation; evidence of technical restriction, such as removal of installation rights, application allow listing or package repository control; records of installations performed in the period, tied to an approved change
Common gap: Missing formal approval for installations
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Records retention schedule · API security standard