How to identify primary information assets

Primary assets can be identified in various ways and methods. Whichever one you use, you should arrive at roughly the same conclusion. Primary assets are the most important data (information) that your organization has, so the list of them must be the same using different methods. Different methods only act as different paths to arrive at such a list of primary assets.

• it is always the collection of data that is of value to the organization as a whole
  
• if you don't have them or they don't work, your organization can't function, can't fulfill its mission
• is at the top of the pyramid, it is the most important data
  
• so it's the data that are essential to your organization's core processes

Basic list of primary assets

Each organization has a different list of its primary assets, depending on its line of business. However, you won't go wrong if you're working from the following list, which most companies will fall within:

• your business data, transaction data
• your customer data
• personal data of your employees
• your know-how
• data about your products or technologies (e.g. formula, source code)
• login details (for banking, other systems)
• all internal data marked as confidential

Basic principles in identifying primary assets

• Always evaluate primary assets together with the top management of the company, they know very well which information is key, they will help to create the "big picture"
• Establish criteria together to help you determine what is key and critical to your business 
• The appropriate number of primary assets for most small and medium-sized companies is 3-10
• Concentrate on mission-critical assets and elements
• For each of these, answer the question about what their loss, damage or unavailability might do to you
• You can create the list of supporting assets with technical experts, but the list of primary assets must be created in collaboration with the company's senior management
• Feel free to use multiple methods crosswise, you will be more confident that you haven't forgotten any, or that you've identified your primary assets correctly

Basic procedure for identifying primary assets

1. Identify the key information without which your organization cannot function. Help yourself with the phrase "if we lose it, we're done" or "if someone misuses it, we're in big trouble"
2. List 3-10 basic ones, this will help you not to drown in detail
3. Name the impact for each. On a scale of "we won't know it" to "we won't be able to work", what is the impact of losing them?
4. Evaluate whether it is truly a primary asset and not supporting assets
5. Repeat points 1-4 until you have a satisfactory result and level of detail, being careful not to include supporting assets.

Once you have a list of primary assets, create a list of supporting assets. These play a key role in the availability of primary assets. You can already create the list of supporting assets with technical experts.

Methods you can use to identify primary assets

Here are the different methods for identifying primary assets

• Brainstorming with top management
• Reference list in your field
• Analysis of main processes and outputs
• ACA (Asset Criticality Analysis)
• VSM (Value Stream Mapping)
• HAZOP (Hazard and Operability Study)
• Analysis mission critical data
• Risk assessment

Examples of primary assets

• customer billing data
• contact details of your customers
• patents and copyrights
• company financial data
• login details for making payments
• personal data of employees
• proprietary software - source code
• scientific research results
• schematics and internal production processes and workflows
• formulas