1. Introduction

Information assets, like any other asset of an organisation, need to be identified and managed so their maximum value can be utilised and they can be appropriately accessed, used, shared and disposed of.

2. Discovery

Discovery is the first step to identifying what information and records are held, who holds them, how they are held and managed, what strategic and operational objectives they support, and how they are used throughout the organisation and its ecosystem. An organisation may already have existing resources it can use to help in this discovery, for example, an approved disposal authority, business process maps, and information audit reports or surveys.

2.1 Assessing

To assess whether something is an information asset, ask the following questions:

  • Does it have a value to the organisation? Will it cost money to reacquire? Would there be legal, reputational or financial repercussions if it cannot be reproduced on request? Would it have an effect on operational efficiency if it could not be accessed easily? What would be the consequences of not having it?

  • What is the level of risk associated with the asset? Risks include: loss, inaccuracy, tampering, and inappropriate disclosure.

  • Does the organisation understand the content of the asset is and what it is for? Does the asset include all the context necessary to understand and identify it?

  • Does the asset have a manageable lifecycle? Were all the constituent parts created for a common purpose? Will they be disposed of in the same way and according to the same rules?

2.2 Grouping

Assessing every individual file, database entry or piece of data an organisation holds as an information asset isn’t realistic or useful. Aggregate or group information and records into manageable units - an information asset is defined at a level of granularity that allows its constituent parts to be managed usefully as a single unit. Too broad and there will not be enough detail, too fine and there will be too many assets to manage effectively.

There are several factors that influence the granularity of an information asset such as common associations and logical information groupings, and a dominant and logical concept.

If identifying the dominant concept is difficult, it may indicate that the asset is too large and needs to be split into smaller, more conceptually distinct groupings. If only one concept can be identified, the asset may be too narrowly scoped. This is particularly important as some information and records on their own may offer little capability to support business processes, assist in decision making or add business value.

3. Examples of information assets

  • A database of contacts is an example of a single information asset. Each entry in the database is not treated individually; the collection is considered one information asset.

  • All the information and records associated with a specific project may be considered a single information asset, such as spreadsheets, text documents, images, emails to and from project staff, etc.

  • Information and records with varied content managed in an enterprise content management system should not be identified as a single information asset – the system is the container only.

4. Information asset register

In order to appropriately manage, understand, access, share and dispose of information assets, organisations should document and maintain details about them in an information asset register.

The Department of Internal Affairs’ Government Enterprise Architecture team, which supports the Chief Executive’s role of Government Chief Digital Officer, has developed an information asset catalogue template and guidelines which organisations can use as a starting point to create their own register. A link to these can be found in the Implementation Guide for the Information and records management standard.

4.1 Benefits of an Information Asset Register

An information asset register can help organisations by:

  • providing a single location for documentation about information assets to facilitate maintenance

  • documenting the links between business requirements and information assets

  • defining and managing the accessibility and usability of assets

  • identifying who is accountable and responsible for them

  • identifying and mitigating any risks and/or changes that might affect the assets

  • managing the relevance, currency, retention and disposal of the assets.

4.2 Key attributes

The following are examples of key attributes that should be included in an information asset register:

Name/Identifier: Identifies and categorises the information asset

Description: Summarises the content of the asset and relationship to the business functions(s) of the organisation

Users: Documents who created the asset, who is responsible, how often is it updated, to what extent it is managed, etc.

Value: Describes the significance of the asset to the organisation, ie. its business value, and if it meets any of Archives New Zealand's criteria for long-term or archival value

Lifecycle: Manages the retention and disposal rules of the asset. ie. how long it needs to be retained, what are the disposal triggers, what is the final disposal action, etc.

Access: Manages the liabilities and risks of the use and re-use of the asset by documenting any security and privacy considerations, information sharing arrangements, copyright, etc.

Storage Environment: Ensures the appropriate continuity and migration of the asset through business and/or technology changes by identifying physical and /or technological dependencies.

5 Information asset checklist

Organisations are encouraged to use this checklist when identifying their information assets, as well as when assessing and determining their preliminary value and risk. It can be used during an information audit, profiling exercise, or as a quality assurance mechanism prior to capturing in an information asset register.

An information asset should be documented even if the status of the information set remains unclear. Even with the best guidelines, areas of ambiguity and doubt about the status of some information assets will exist. Ultimately, if an organisation is in doubt about the status of a particular group of information and records, it is recommended to treat the group as an asset and include it in the information asset register. Subsequent review will then allow for further refinement of the registered details.

5.1 Step 1: Discovery of an information asset

The guidelines and questions below will assist in determining whether a group of information and records are an information asset or not.

5.1.1 Guidelines

An information asset has value for an organisation where an item contained in the asset is:

  • required as input to a business process or is the output of a business process

  • used to evaluate a rule or condition

  • subject to a typical information lifecycle (create, store, access, use, maintain and dispose) where the organisation is responsible for some or all stages of the lifecycle.

Information will only be an information asset if it is held and maintained by an organisation according to the guidelines above. External reference material or information provided for context is generally not considered to be an information asset.

An information asset exchanged between organisations on a regular cycle is to be treated as an asset of both organisations. The same is true for information that is commissioned by an organisation and involves a third party external provider.

5.1.2 Questions

Question 1a: Are the information and records used as input or output of a business process? Yes/No

Question 1b: Are the information and records used in a decision making process? Yes/No

Question 1c: Are the information and records used to evaluate a rule or condition? Yes/No

Question 1d: Are the information and records subject to a typical lifecycle (i.e. create, store, access, use, maintain and dispose)? Yes/No

Question 1e: Are the information and records received from an external organisation or source and exchanged on a regular basis? Yes/No

If the answer to any one of these questions in step 1 is ‘Yes’, a potential information asset has been identified and can be assessed under step 2. If the answer is ‘No’ to all questions, this is probably reference information that need not be registered or reported.  

5.2 Step 2: Confirm the aggregation or grouping of the information asset

The guidelines and the questions below will assist in determining whether the information assets are defined at a consistent level of granularity.

5.2.1 Guidelines

An information asset is a grouping with a logical, dominant concept having a common purpose or function, rather than determined by related applications or technologies.

5.2.2 Questions

Question 2a: Does the information asset represent a collection of business information and records?

No – Go to Q2b.

Yes – Go to Q2c.

Question 2b: Are the information and records part of an existing information asset?

No – Identify any other information that comprises the asset as in step 1. Then go to Q2c.

Yes – Merge the information assets and adjust the description. Return to step 1.

Question 2c: Does the information and records contain a logical, dominant concept?

No – Divide the information asset into smaller groupings and adjust the description. Return to step 1.

Yes – Go to step 3.

5.3 Step 3: Check the name of the information asset

The guidelines and questions below will assist in determining whether the information asset is named correctly.

5.3.1 Guidelines

In the majority of cases, a single system or application will contain multiple information assets. Information assets are considered to be conceptually separate from, and exist independently of, the system or application that contains them.

5.3.2 Questions

Question 3a: Is the information asset already named independently of any system or application?

No – Revise the name in consultation with business representatives.

Yes - Register the information asset in an information asset register.

Question 3b: Is the information asset named using the organisation’s common business terminology?

No – Revise the name in consultation with business representatives.

Yes - Register the information asset in an information asset register.