Theory - The core asset of the business is its information. Information is created and maintained by the business' processes and applications, which are managed and stored within the technology and facility infrastructure. Using this theory all you would need is to identify all the information components within the business and then work down the chain to inventory the processes, technology, etc. Or you could use a bottoms up approach and start with the infrastructure.

Reality - Few businesses have organized their information or inventory into a clear hierarchy that identifies the inter-relationships. Some businesses do not even have a baseline inventory of computer systems or software.

So where do you start when conducting an inventory? In the middle.

Likely much of the high level inventory work has already been performed by senior management. Just ask for a detailed organization chart for the company. It represents the business' best guess at where resources need to be focused and it likely represents the high level prioritization of the processes within that business. Sitting down with management and having them go through the org chart is often the best way to kick off an assessment. It will also provide a good vehicle for discussing management's perception of the existing and future risks within the business and identifying th senior managers you will need to talk with as part of the detailed inventory.

Once you have the processes properly identified and prioritized you can expand outward to identif the related types of information and the infrastructure that manages that information.

Now you can start asking specific questions:

©2009 ISRMC, LLC