Asset management
Asset management shows which physical and intangible assets a core service depends on, so the resource and single-point-of-failure work in 5.7 rests on a real inventory rather than an assumption.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names asset management as a discipline that can support the coordination required by 5.8. The standard does not define the discipline's scope. In practice it identifies the assets that matter to the organization's objectives, records their condition and ownership, and connects them to the services they support. For resilience, the useful output is not a complete fixed-asset register. It is a short list of the assets whose loss or degradation would stop a core service, with the owner and the recovery path.
Why it matters
Asset registers often grow for accounting reasons and shrink for operational ones. The resilience question is different from the depreciation question: an asset can be fully depreciated and still be critical, and a valuable asset can be irrelevant to service continuity. The discipline earns its place in clause 5.8 when it can answer which assets carry the service, what condition they are in, and what happens if they are unavailable. That answer also informs the resource review in 5.7 and the dependency map in 5.3.
What good looks like
Take each core service and trace it to the assets it needs: premises, plant, vehicles, equipment, data, software and intellectual property. Record the owner, condition and expected life. Mark the assets whose loss would stop the service and the time to replace or recover each. Review the list when a service changes or an asset is replaced. Keep the accounting register as the source of record and maintain the resilience view as a separate, shorter list.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask which assets are critical to a core service and how the organization knows. A complete asset register that cannot answer that question is not yet serving resilience.
- Critical asset list The assets whose loss would stop a core service, with the service they support
- Condition record The condition and expected life of each critical asset, with the last inspection
- Recovery path The replace, recover or substitute route for each critical asset and the time it takes
- Ownership The named owner and the maintenance or replacement budget line
Where it commonly fails
- The asset register is maintained for accounting and never read for continuity.
- Critical assets are identified by value rather than by service dependency.
- No one owns the replacement decision for a critical asset.
What to do before the second edition
Ask the operations lead to name the five assets the organization could least afford to lose. Compare that list with the register. The difference is the work.
Read across
- 5.3 Understanding and influencing context
- 5.7 Availability of resources
- 5.8 Development and coordination of management disciplines
- 6.3.1 Methods and processes