Ngā rawa mōhiohio: Te tautuhi 

Information assets: Identification

Discovery is the first step

There is no set process for how your organisation defines what is and what isn’t an information asset. Discovery is the first step to identifying:

• what information assets are held by your organisation

• who is responsible for them

• how they are held and managed

• what strategic and operational objectives they support, and

• how they are used throughout the organisation and its ecosystem.

If your organisation is a public sector organisation , you may already have existing resources you can use to help in this discovery. For example, you may have:

• an approved disposal authority

• business process maps, or

• information audit reports and surveys.

Information asset checklist

Use the following steps and questions in our checklist to identify your organisation's information assets. You can also use these steps to assess and determine your information assets' preliminary value and risk. Before documenting the results in an information asset register, use this checklist during:

• an information audit

• a profiling exercise, or

• as a quality assurance mechanism.

Document even if a grouping status is unclear

Document an information asset even if you're unsure of its grouping status in Step 2. Even with the best guidelines, the status of some groupings may be unclear. We recommend that you treat an unclear grouping as a single asset and document this in the information asset register. You can always review and refine these later.

Step 1: Assessing

To determine whether something is an information asset or not, find someone in your organisation who works with the information and records to help you answer the following.

Does the asset have a value to your organisation?

• Will it cost money to reacquire?

• Would there be legal, reputational or financial repercussions if it cannot be reproduced on request?

• Would there be an effect on operational efficiency if it could not be accessed easily?

• What would be the consequences of not having it?

What is the level of risk associated with the asset? These may include: loss, inaccuracy, tampering or inappropriate disclosure.

Does your organisation understand the content of the asset and what it is for? Does the asset include all the context necessary to understand and identify it?

Does the asset have a manageable lifecycle?

• Were all the parts of the whole asset created for a common purpose?

• Can they be disposed of in the same way and according to the same rules?

Processing questions for Step 1

• 1a. Are the information and records used as input or output of a business process? Yes/No

• 1b. Are the information and records used in a decision-making process? Yes/No

• 1c. Are the information and records used to evaluate a rule or condition? Yes/No

• 1d. Are the information and records subject to a typical lifecycle (i.e. create, store, access, use, maintain and dispose)? Yes/No

• 1e. Are the digital records received from an external organisation or source and exchanged regularly? Yes/No

Assessment

• If the answer to any one of the processing questions in Step 1 is ‘Yes’, you've identified a potential information asset. Group it in Step 2.

• If the answer is ‘No’ to all questions, this is probably reference information that doesn't need to be registered.

Step 2: Grouping

An information asset is a grouping of information, records and/or data. It has a logical, dominant concept with a common purpose or function, rather than related applications or technologies.

Assessing every individual file, database entry or piece of data your organisation holds as an information asset isn’t realistic or useful. Try to group information and records into manageable units. Define your information assets at a level of granularity that allows you to manage their related constituent parts (if they exist) usefully as a single unit.

• If the information grouping is too broad, there won't be enough detail to manage the asset.

• If it is too fine, there will be too many assets to manage effectively.

• If it's difficult to identify the dominant concept, the asset may be too large. It may need to be split into smaller, more conceptually distinct groupings.

• If you can only identify one concept, the asset may be too narrowly scoped.

Points to note about grouping

• Group information assets according to their business needs and objectives, not by their technology requirements.

• If a piece of information could logically belong within two different assets, choose one to avoid conflicts of ownership and control.

• If information assets contain other assets, you need clear rules for their different management and retention periods.

• Information groupings may change over time. For example, one asset may contain information and records that will be archived.

Processing questions for Step 2

• 2a. Does the information asset represent a collection of business information and records?

  • No — go to Q2b.

  • Yes — go to Q2c.

• 2b. Are the information and records part of an existing information asset?

  • No — identify any other information and records that make up the asset as in Step 1. Then go to Q2c.

  • Yes — merge the information assets and adjust the description. Return to Step 1.

• 2c. Do the information and records have a logical, dominant concept?

  • No — divide the information asset into smaller groupings and adjust the description. Return to Step 1.

  • Yes — go to Step 3.

Step 3: Naming

It's common for a single system or application to contain multiple information assets. Information assets are considered to be separate from, and to exist independently of, the system or application that contains them.

Processing questions for Step 3

• 3a. Is the information asset already named independently of any system or application?

  • No — revise the name in consultation with someone in your organisation who works with the information and records.

  • Yes — document the information asset in an information asset register.

• 3b. Is the information asset named using your organisation’s common business terminology?

  • No — revise the name in consultation with your organisational representative.

  • Yes — document the information asset in an information asset register.

We’ve removed the PDF for this page to keep information on this page up to date and easy to access.

You can easily print or save the page as a PDF using your browser’s print option. Press Ctrl (or Command) + P to preview. Another option is to click the 'Print page' link near the bottom of this page.

If you still need a separate PDF, we're happy to help. Email us at rkadvice@dia.govt.nz.