How it works
A physical space contains assets: laptops, servers, badges, paper records, network ports, cameras, storage cabinets, and people.
Map where an asset lives, who touches it, what happens if it is lost or changed, and whether the space supports that risk level.
Common error
A locked door does not protect data if credentials are taped to the monitor or devices remain signed in.
Worked example
Inventory a classroom with shared tablets, an unlocked cabinet, and a visitor-accessible network socket.
Evidence
Asset: 12 tablets
Storage: unlocked cabinet
Port: visitor-accessible
Inventory: last checked 6 months agoAssess theft, unauthorized use, and network exposure separately. Locked storage and checkout records address tablet handling; an approved access-control policy addresses the exposed port. Reconcile the inventory so missing assets can be distinguished from tracking errors.
Exercises
2.1.1
Identify two assets and two exposures in a reception area with a shared computer and printed visitor records.
Show solution
Assets include the computer and personal information on the paper records. Exposures include unattended unlocked access and records visible or removable by visitors.
2.1.2
Why should an asset inventory record an owner and location rather than only a device serial number?
Show solution
Ownership assigns responsibility and location supports verification and incident response. A serial number identifies the asset but does not explain who should control it or where it should be.