Skip to main content
Control Institute
Category: Risk Assessment and Treatment

Asset Valuation

Also known as: Asset Valuations
Simply put

Asset valuation is the process of estimating the worth or value of an organization's assets, which can include both tangible items such as buildings and equipment and intangible items such as information and IT assets. It helps an organization understand what its assets are worth so that decisions can be made about how to protect and manage them. The specific value assigned typically depends on the method used and the context in which the assessment is performed.

Formal definition

Asset valuation is the process of determining the value of an organization's tangible and intangible assets, including physical property, financial instruments, and IT assets. In an information security and risk management context, valuation supports risk assessment activities by helping to characterize the importance or worth of assets so that appropriate protective measures can be prioritized; within an ISO/IEC 27001 ISMS, for example, understanding asset value typically informs risk assessment inputs used to select and justify controls via the Statement of Applicability. Valuation methods and outputs vary by context and technique (such as absolute versus relative valuation approaches), and the resulting figures depend on scoping decisions and the criteria applied rather than a single universal standard.

Why it matters

Asset valuation matters because an organization cannot make sound decisions about protecting its assets without understanding what those assets are worth. In an information security and risk management context, valuation helps characterize the importance of tangible assets such as buildings and equipment and intangible assets such as information and IT assets, so that protective measures can be prioritized against the assets that matter most. Without this understanding, security investment can be misallocated, over-protecting low-value assets while leaving high-value ones exposed.

Within an ISO/IEC 27001 ISMS, understanding asset value typically feeds into risk assessment activities, which in turn inform the selection and justification of controls documented in the Statement of Applicability. Because valuation outputs depend on the method used and the scoping decisions applied, the figures should be understood as context-dependent estimates rather than fixed, universal values. This qualification is important: two organizations, or even the same organization under different criteria, may reasonably assign different values to comparable assets.

It is worth noting that asset valuation supports prioritization but does not by itself guarantee protection. A valuation informs where controls may be warranted; it does not implement those controls or ensure they operate effectively, and it does not eliminate the possibility of a security incident affecting a valued asset.

Who it's relevant to

GRC and Risk Managers
Risk management professionals use asset valuation to characterize the worth or importance of assets so that risk assessment activities can prioritize protective measures. Because valuation outputs vary by method and scope, these practitioners need to document the criteria applied so that results are defensible and repeatable.
ISO 27001 ISMS Owners
Those responsible for an ISO/IEC 27001 ISMS may draw on asset valuation as an input to risk assessment, which in turn informs the selection and justification of controls recorded in the Statement of Applicability. Understanding asset value helps ensure that control decisions reflect the relative importance of the assets within the defined ISMS scope.
IT Asset Management (ITAM) Teams
In an ITAM context, asset valuation refers to estimating the worth of an organization's IT assets. These teams apply valuation to support decisions about how IT assets are protected and managed, recognizing that assigned values depend on the method and context used.
Finance and Business Leaders
Finance and business stakeholders are concerned with the value of both tangible assets, such as buildings and equipment, and intangible assets, such as information. Asset valuation gives them a basis for understanding what the organization's assets are worth so that management and investment decisions can be made with that context in mind.

Inside Asset Valuation

Asset Identification
The process of cataloging information assets within a defined scope, including data, systems, applications, hardware, and supporting infrastructure. In an ISO 27001 context this typically feeds the risk assessment that informs Annex A control selection via the Statement of Applicability.
Valuation Criteria
The factors used to assess the worth or importance of an asset, which may include confidentiality, integrity, and availability impact, as well as business, legal, or operational significance. The specific criteria depend on the organization's scope and risk methodology rather than a single prescribed standard.
Impact Assessment
An evaluation of the potential consequences to the organization if an asset's confidentiality, integrity, or availability were compromised. This assessment typically supports the broader risk assessment process within ISO 27001 clauses 4 through 10 and can also inform the scoping of SOC 2 Trust Services Criteria such as Availability or Confidentiality.
Asset Ownership
The assignment of responsibility for each asset to an accountable owner who oversees its protection and appropriate handling. Ownership assignment is commonly referenced among the reference controls in ISO 27001 Annex A, though its application is informed by the organization's risk assessment and Statement of Applicability.
Classification Linkage
The relationship between an asset's assessed value and its information classification level, which in turn typically drives the handling, storage, and protection controls applied. Classification schemes vary by organization and scope.

Common questions

Answers to the questions practitioners most commonly ask about Asset Valuation.

Is asset valuation a mandatory step required by ISO 27001?
ISO 27001 does not prescribe a specific asset valuation method or require a formal monetary valuation exercise. The certifiable requirements in clauses 4 through 10 call for a risk assessment process, and understanding the value or importance of assets typically supports that process, but the standard leaves the approach to the organization. Depending on scope and the risk methodology chosen, some organizations use qualitative importance ratings rather than a distinct valuation activity. Treat asset valuation as a supporting practice informed by risk assessment rather than a standalone mandatory clause.
Does SOC 2 require the same asset valuation exercise as ISO 27001?
Not in the same way. SOC 2 is an attestation examination performed by a licensed CPA firm under the AICPA SSAE 18 standard against the Trust Services Criteria, with Security (the Common Criteria) required and other categories optional based on scope. The Common Criteria address risk assessment activities, and understanding what assets are in scope generally informs that, but SOC 2 does not mandate a prescribed asset valuation methodology. Asset valuation as a formal discipline is more commonly associated with ISO 27001's ISMS risk work, and the two frameworks map only partially, so satisfying one does not automatically satisfy the other.
How do we decide which assets to include in an asset valuation for our ISMS?
In most engagements, the assets you value align with the defined scope of the ISMS, since an ISO 27001 certificate covers only that defined scope. Organizations typically identify information assets, supporting systems, and services relevant to the scope boundary, then assess their importance to the confidentiality, integrity, and availability of information. The exact inventory depends on your scoping decisions and risk assessment approach, so document the rationale for inclusion and exclusion rather than aiming for a universal asset list.
Should we use a qualitative or quantitative approach to asset valuation?
Both approaches are commonly used, and the choice depends on your risk methodology and the maturity of your program. Qualitative scales (for example, low/medium/high importance) are often simpler to apply consistently, while quantitative valuation attempts to assign monetary or measurable values. ISO 27001 does not require a specific method, so many organizations adopt a qualitative or hybrid approach. Whichever you select, apply it consistently across in-scope assets so the results feed reliably into risk assessment and, where relevant, into control selection via the Statement of Applicability.
How does asset valuation connect to the Statement of Applicability?
In ISO 27001, Annex A lists reference controls that are selected through a Statement of Applicability and informed by risk assessment. Understanding the value or importance of an asset typically influences the assessed risk, which in turn informs which Annex A controls you determine to be applicable. Note that Annex A was restructured in the 2022 revision, so the control set you reference depends on the edition you are certifying against. Asset valuation is therefore an input to risk-based decisions rather than a direct mapping to any fixed control.
How often should asset valuations be reviewed or updated?
Review frequency is generally driven by the ISMS's own requirements for maintaining and improving the risk assessment, and by significant changes to assets, scope, or the threat environment. In most programs, valuations are revisited during periodic risk assessment cycles and after material changes such as new systems, mergers, or scope adjustments. There is no single mandated interval, so define a review cadence in your process documentation and revisit it when circumstances change, keeping the valuation aligned with the current defined scope of the ISMS.

Common misconceptions

Asset valuation requires assigning a precise monetary figure to every asset.
Valuation can be qualitative (for example, high/medium/low impact) rather than strictly monetary. The approach depends on the organization's chosen risk methodology and scope, and neither framework prescribes a single mandatory valuation method.
Completing an asset valuation for ISO 27001 automatically satisfies SOC 2 requirements, or vice versa.
Mapping between the two frameworks is possible but partial. ISO 27001 uses asset valuation to inform risk assessment and Annex A control selection, while SOC 2 evaluates controls against the Trust Services Criteria under an AICPA SSAE 18 examination. Satisfying one does not automatically satisfy the other, and the Trust Services Criteria are distinct from ISO 27001 Annex A controls.
A documented asset valuation guarantees the organization is protected from breaches or that its controls are effective.
Asset valuation is an input to risk assessment, not a guarantee of security. A SOC 2 report attests only to the controls and period covered, and an ISO 27001 certificate covers only the defined scope of the ISMS; neither ensures freedom from breaches.

Best practices

Define the scope of assets before valuation so that identification aligns with the boundaries of your ISMS (for ISO 27001) or the system covered by your SOC 2 examination.
Choose a valuation approach (qualitative, quantitative, or a hybrid) appropriate to your organization's size and risk methodology, and document the criteria consistently across assets.
Assess impact in terms of confidentiality, integrity, and availability so that valuation results feed directly into your risk assessment and control selection decisions.
Assign a documented owner to each asset to maintain accountability for its protection and to support consistent handling based on classification.
Link asset valuation to your information classification scheme so that higher-value assets receive proportionate handling and protection controls.
Review and update asset valuations periodically and after significant changes, and retain the documentation to support your Statement of Applicability, risk assessment, or auditor review as applicable.