This domain has controls around safeguarding assets. Some of the controls that this domain deals with are around the imagery of assets, ownership of assets, acceptable use of assets, and return of assets. It suggests controls around maintaining an inventory of assets and whether that inventory is current and kept up to date. Also, it suggests that all information assets must have a clearly-defined owner who is aware of their responsibilities. We'd suggest that there be an acceptable use policy in place and that there is a process in place by which all employees are made aware of such policies. It also suggests controls and/or classification of information and suggests that the organization have a process for deciding priority of information. This is important because if an organization is aware which information as it is more important, then it can focus its resources on securing that first before focusing on less important ones.

You will see that a fundamental recurring theme in all security frameworks, is the assumption that resources such as time and money are scarce. It also suggests that once an information asset is classified, that they be appropriately labeled. Once we have classified and labeled our assets, there needs to be procedures defined about how different classes of information assets be handled. Effectively there needs to be more care given to highly confidential assets rather than an asset lower down on the totem pole of importance. Also, processes around making employees aware of these procedures, needs to be put in place. What is the point of writing a procedure if no one knows about it?

This section also talks about removable media and defining processes around handling of removable media. It is pointless to secure a server than it is in the data center running a cloud application and collecting data, if we are going to place it in a insecure work area when we are doing maintenance. Anybody can then tap in and copy the information that is present in the hard drive. So a lot of importance has to be given to these removable media, such hard drives and USB drives. Also, if there arises a situation when these drives have to be destroyed, we need to make sure that these drives are thoroughly wiped clean of the confidential data that they may possess before being trashed.

Some of these drives may need to be transported from one data center to another. In such situations we need to make sure that they are transported in a safe and secure manner. For example, you may want to make sure that they are encrypted and transported via FedEx in a lockbox. In the case of assets owned by employees while quitting the organization, we need to make sure that those assets are returned and wiped clean of data before they are reissued to other employees.