How to answer
Do you maintain an inventory of systems and assets?
You probably have three inventories already and have never called them that.
Yes. Production infrastructure is defined in code, so the repository is the authoritative inventory and changes to it are reviewed. Employee devices are inventoried in [your device management tool], and third-party services are recorded in our vendor list.
Square brackets are yours to fill in. FillTrust grades an answer like this implied, not stated when your documents support it.
- Answered from
- Your infrastructure-as-code repository, your device management tool, and your vendor or sub-processor list.
- Evidence to attach
- Rarely requested in full. Where it is, a summary by category is normally accepted rather than a full export.
- Where it is asked
- CAIQ v4.0 · DCS-06SIG LiteISO 27001 Annex A · A.5.9
Reviewers ask this because you cannot protect what you do not know you have, and because a company that cannot list its systems usually cannot answer the access, patching and offboarding questions either.
There are three inventories, not one, and separating them makes this easy to answer.
Infrastructure. If your cloud resources are defined in Terraform, OpenTofu, CloudFormation or similar, that repository is your inventory and it is authoritative by construction: something not in it does not exist in production. That is a stronger answer than any spreadsheet, and it is worth saying in exactly those terms.
Devices. Laptops and phones, enrolled in a management tool that reports what exists and what state it is in. If they are not enrolled, the honest version is a list maintained at onboarding.
Services. The tools the company pays for that hold company or customer data. This is the inventory almost nobody keeps, and it is the one that quietly grows: a design tool here, an analytics product there, each one with an account and some data in it. Your sub-processor list covers the ones touching customer data. The rest are worth a page.
Generated beats maintained. Wherever the inventory falls out of a system that has to be correct for other reasons, say so. A manual asset register updated by hand is the classic control that is perfect on day one and wrong by month three, and reviewers have seen enough of them to be sceptical.
Ownership is the follow-up. Fuller versions of this question ask who owns each asset. For a small team the answer is usually one or two names, and giving them by role rather than by person keeps the answer true after somebody leaves.
This usually grades as implied: your documentation refers to your infrastructure without ever claiming an inventory exists. One paragraph naming the three sources above turns it into a confirmed answer, and it is a paragraph that describes what you already do.
How this one goes wrong
Specific to this question, not general advice.
- Reading "asset inventory" as a spreadsheet you have to create. If your infrastructure is in code and your laptops are enrolled, you already have two of the three inventories.
- Forgetting software-as-a-service. The tools the company signs up for are assets holding company data, and they are the ones nobody tracks.
- Maintaining a manual list that has diverged from reality. An inventory that is wrong is worse than one that is generated.