Asset Management Policy¶
Purpose. Ensures Soon knows what information and associated assets it has, who owns them, how sensitive they are, and that they are protected accordingly and handled correctly through their lifecycle.
1. Scope¶
Applies to all assets in the ISMS scope: information/data (customer workforce data, source code, business records), Soon-built services, cloud infrastructure and SaaS services, and endpoint devices used by the remote team. Soon has no offices or data centres; physical infrastructure is operated by cloud providers, so on-premises asset controls do not apply.
2. Policy¶
2.1 Asset inventory and ownership¶
- All in-scope assets are recorded in the Information Asset Inventory (ISMS-DOC-A05-9-2), which is the input to the risk assessment.
- The inventory is reviewed quarterly and on any significant infrastructure change.
- Every asset has a named owner (person or role) who is accountable for: its inventory entry, its classification, who has access to it, and its correct handling and disposal. Asset owners were assigned 2026-08-13; any remaining unassigned entries must be confirmed before approval.
2.2 Information classification¶
All information is classified on the scale used in the asset inventory: Public · Internal · Confidential · Restricted. Classification is based on legal requirements (notably GDPR — customer workforce data is Restricted), value, criticality and sensitivity to disclosure or modification. The owner assigns the classification; handling (storage, sharing, access) must match it, per the Acceptable Use Policy. Where tools support it, documents and repositories should indicate their classification.
2.3 Handling and endpoints¶
- Company information must be stored and processed only in approved cloud services; endpoints (laptops, phones — including BYOD) are governed by the Mobile Device / BYOD policies and must use disk encryption and screen lock.
- Removable media must not be used to store Confidential or Restricted information; approved cloud sharing is the standard transfer method. Exceptions are agreed with the ISM and recorded in the weekly ISMS meeting minutes; no separate exception process is needed at current size.
2.4 Return of assets¶
On termination of employment or contract, all company assets must be returned or, for BYOD equipment, company data and access must be removed on the last working day, as part of same-day offboarding (see the Access Control Policy).
3. Roles & responsibilities¶
- Asset owners — maintain their inventory entries, classify assets, control access, decide handling rules.
- ISMS owner (Olaf Jacobson) — owns the inventory document and its quarterly review.
- Managers — ensure return of assets / data removal at offboarding.
4. Related documents¶
- Information Asset Inventory
- Acceptable Use Policy
- Access Control Policy
- Mobile Device Policy / BYOD Policy
- Backup Policy
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2023-12-11 | Olaf Jacobson | First draft document |
| 0.2 | 2026-07-18 | Andrea Cardinali | Tailored to Soon (ISMS overhaul) — aligned with the Information Asset Inventory and its classification scale; dropped office/physical-media content |