Hardware Asset Inventory for SOC 2 and ISO 27001

SOC 2 and ISO 27001 auditors want a current hardware inventory with a named owner per device, proof that leavers returned equipment, and proof that retired devices were wiped or destroyed. ISO 27001:2022 controls 5.9, 5.11, 7.10 and 7.14, SOC 2 criteria CC6.1 and CC6.5, CIS Control 1 and NIST CSF ID.AM all point to the same evidence.

A surprising share of SOC 2 and ISO 27001 sample requests are about physical things. Auditors ask for a list of laptops, the name of the person holding each one, what happened to the laptop of the person who left in March, and where the drives from last year's server refresh ended up.

Below is what the main frameworks say about hardware inventory, quoted by their own control and criterion references, followed by the evidence pack you should be able to produce on request. What follows keeps to what the published texts and the AICPA's public criteria document actually say. ISO 27001 itself is a paid standard, so for its controls I cite the titles and public summaries rather than the text.

What each framework asks for

ISO/IEC 27001:2022

The 2022 edition, listed on ISO's page for ISO/IEC 27001:2022, reorganised Annex A into 93 controls grouped into four themes (organisational, people, physical and technological). Under the International Accreditation Forum's IAF MD 26 transition requirements, certification bodies had to move certified organisations onto it by 31 October 2025. Five Annex A controls bear directly on hardware.

5.9 Inventory of information and other associated assets. An inventory, including owners, is developed and maintained. It merges the 2013 controls A.8.1.1 (inventory of assets) and A.8.1.2 (ownership of assets), according to ISMS.online's summary of 5.9.
5.10 Acceptable use of information and other associated assets. Rules for using and handling assets are documented and implemented; this is where an equipment policy lives.
5.11 Return of assets. Personnel and other interested parties return the organisation's assets in their possession when their employment, contract or agreement changes or ends (High Table's explanation of 5.11).
7.10 Storage media. Media is managed through its life cycle from acquisition to disposal. ISMS.online's summary of 7.10 notes that it replaces the 2013 controls on media handling, disposal, transfer and physical media security.
7.14 Secure disposal or re-use of equipment. Equipment containing storage media is checked so that sensitive data and licensed software are removed or securely overwritten before disposal or re-use; it replaces 2013 control A.11.2.7, per ISMS.online's summary of 7.14.

Note the word 'owners' in 5.9. An inventory that lists 400 laptops under 'IT' as the owner is a list of laptops, not an inventory in the sense the control intends.

SOC 2: the AICPA Trust Services Criteria

SOC 2 reports test controls against the AICPA's 2017 Trust Services Criteria (with revised points of focus, 2022). The criteria are fixed. The points of focus beneath them are described in the document as highlighting important characteristics, so they guide design and are not a mandatory checklist. Hardware turns up under five criteria.

Criterion	What it says (summarised from the AICPA text)	Hardware relevance
CC3.2 (risk assessment)	A point of focus calls for identifying information assets, including physical devices and systems, and assessing their criticality	You cannot assess the risk of devices you have not listed
CC6.1 (logical access)	Point of focus: the entity identifies, inventories, classifies and manages information assets	The inventory itself
CC6.4 (physical access)	Restricts physical access to facilities and protected information assets to authorised personnel	Server rooms, spares stores, backup media
CC6.5 (disposal)	Discontinues logical and physical protections over physical assets only after the ability to read or recover data and software has been diminished and is no longer required	Wiping and destruction before disposal
CC6.7 (transmission and removal)	Points of focus cover protecting removable media and protecting mobile devices such as laptops, smartphones and tablets	Laptop encryption, USB control, device custody

Read the two points of focus under CC6.5 literally. One says procedures exist to identify data and software on equipment to be disposed of and render it unreadable. The other says procedures exist to remove data and software from equipment leaving the entity's physical control, and that covers a laptop that leaves with a departing contractor just as much as one sent to a recycler.

If you hold both certifications, the AICPA publishes a mapping of the 2017 Trust Services Criteria to ISO 27001, which helps you build one evidence pack for both audits.

CIS Critical Security Controls, Control 1

CIS Control 1, Inventory and Control of Enterprise Assets, asks you to actively manage all enterprise assets, including end-user devices, network devices, IoT devices and servers, whether connected physically, virtually, remotely or in the cloud. It is unusually specific about content and frequency.

The CIS Controls v8.1 assessment specification spells it out. Safeguard 1.1, which applies to all implementation groups, calls for a detailed inventory of all assets able to store or process data, recording network address if static, hardware address, machine name, enterprise asset owner, department, and whether the asset is approved to connect, reviewed and updated bi-annually or more frequently. Safeguard 1.2, also for all groups, requires a process to address unauthorised assets weekly by removing, denying or quarantining them. The larger implementation groups add safeguards 1.3 to 1.5: active discovery run daily, DHCP logs reviewed weekly and passive discovery reviewed at least weekly.

NIST Cybersecurity Framework 2.0

The NIST CSF 2.0, published on 26 February 2024, puts asset management under Identify. ID.AM-01 reads 'Inventories of hardware managed by the organization are maintained', and ID.AM-08 reads 'Systems, hardware, software, services, and data are managed throughout their life cycles'. Nobody certifies against CSF, but US customers increasingly use its categories in security questionnaires, so map your evidence to it anyway.

The evidence pack auditors ask for

Across all four frameworks, the requests reduce to a handful of artefacts. Build these once and keep them current, and most hardware-related sample requests become a filter and an export.

Evidence	What good looks like	Maps to
Inventory export, dated	Every in-scope device with tag, serial, model, status, location and a named individual owner; exported on the day of the request	ISO 5.9; CC6.1; CIS 1.1; ID.AM-01
Inventory review record	Dated evidence that someone reviewed and corrected the inventory at the stated interval	CIS 1.1 (bi-annual); ISO 5.9 'maintained'
Acceptable use or equipment policy	Signed or acknowledged by each holder	ISO 5.10
Issue records	Who received which device, when, with acknowledgement	ISO 5.9 owner; CC6.7 mobile devices
Leaver return evidence	For each sampled leaver: list of assets held, return date, condition, who received it	ISO 5.11; CC6.5
Disposal and sanitisation certificates	Per device: serial, method, tool, verification, who did it and when	ISO 7.10, 7.14; CC6.5; ID.AM-08
Physical count results	Dated count with found, missing and corrected items	ISO 5.9; CIS 1.1; ID.AM-01

Leaver evidence: the most commonly sampled item

Auditors testing 5.11 typically sample leavers from HR records and ask for the asset trail for each one. High Table's guidance on 5.11 lists leaver checklists, signed equipment records and access revocation timestamps as common evidence. The test tends to fail the same way. Access was revoked on the day, but nobody can show that the laptop came back, or it came back and was reissued without the return being recorded.

The fix belongs on the first day, at issue. If every device is issued against a named person with an acknowledgement, the leaver's list of held assets already exists on their last day, and the return is a matter of ticking each one off. An employee equipment agreement sets the expectation at the start; the template is a reasonable starting point.

Disposal evidence: what a certificate should record

NIST's SP 800-88 Revision 2, Guidelines for Media Sanitization, published in September 2025, defines three sanitisation methods, clear, purge and destroy, and says a certificate of sanitisation should be completed for each item. These are the minimum details it lists.

Manufacturer, model and serial number, plus your own asset or property number if you have one.
Media type and source (for example, which computer it came from).
Sanitisation method (clear, purge or destroy) and technique, such as overwrite, block erase or cryptographic erase.
Tool used, including version, and the verification method.
Name, title, date, location, contact details and signature of the person who performed verification.

A recycler's bulk certificate that says '312 hard drives destroyed' does not let you prove that a specific laptop's drive was among them. Ask disposal vendors for serial-level certificates, and record the certificate against each asset as it is retired.

A custody register is not a discovery tool, and you need both

CIS safeguards 1.3 to 1.5 assume network discovery: tools that see what is connected. Discovery is good at finding unmanaged devices on the network and poor at everything that is not connected. Think of the spare laptops in a cupboard, a device in a courier van, a broken machine in a drawer, or the laptop a leaver has not returned and will never switch on again.

A custody register works from the other direction. It records what was bought, who was given it, where it is supposed to be and what happened to it at the end. Before an audit, I would reconcile the two in both directions: devices seen on the network but missing from the register, and devices in the register that the network has not seen. Each mismatch is either an unmanaged device or a register error, and both are findings you would rather discover yourself.

Common findings, and what causes them

There is no published, methodologically sound study of how often each hardware-related finding occurs in SOC 2 or ISO 27001 audits, so no percentage is quoted here. What follows are the failure modes the control wording above makes predictable.

Owner is a team, not a person. The inventory lists 'Engineering' or 'IT'. Control 5.9 and CIS 1.1 both ask for an owner, and a team cannot sign for a returned laptop.
Leaver sample with no return record. Access was removed, but there is no evidence of the device coming back.
Disposal without device-level evidence. A bulk recycling certificate, or nothing, for devices marked 'disposed'.
Inventory not reviewed at the stated interval. The policy says six-monthly; the last dated review was 14 months ago.
Register and reality disagree. A spot check in the office finds devices not in the register, or register entries nobody can find.
Reissued devices with no wipe record. A returned laptop goes to a new starter without evidence it was sanitised, which is a 7.14 're-use' issue, not only a disposal one.

Readiness checklist

Run through this list four to six weeks before fieldwork. Each item should end in something you can export or show. A verbal assurance doesn't count.

Define scope: which entities, offices, device types and cloud-hosted hardware are in the audit boundary.
Export the hardware inventory and confirm every in-scope device has a tag, serial, model, status, location and named individual owner.
Reconcile the inventory with your MDM or discovery tool; resolve or explain every mismatch.
Confirm the inventory review cadence in your policy and produce the dated record of the last review.
Pull the leaver list for the audit period from HR and, for each person, show what they held and when each item came back.
For every device marked disposed or reissued in the period, attach a sanitisation or destruction record at serial level.
Check that every current holder has acknowledged the acceptable use or equipment policy.
Run a physical count of at least one office or storeroom, record found and missing items, and correct the register.
Map each artefact to the ISO 27001 control and SOC 2 criterion it supports, so you can answer requests by reference.

Where Stackroom fits

Stackroom is a custody register, not a discovery or MDM tool. It records each device against a named person, captures a signature at handover and return, keeps the holder's acknowledgement, and holds the full custody history per asset and per person. For leavers it shows everything a person still holds and can issue an asset clearance certificate once it is all back, and scoped audits record verified and missing items. Exports are CSV or XLSX, which is the format most auditors want for sampling. If you are building this evidence for the first time, the IT asset management and audits and compliance pages show how those records fit together.

Sources

Key takeaways

ISO 27001:2022 controls 5.9, 5.10, 5.11, 7.10 and 7.14 cover the hardware life cycle from inventory and ownership to return and secure disposal.
SOC 2 has no single inventory criterion; it appears as points of focus under CC3.2, CC6.1 and CC6.7, with disposal covered by CC6.5.
CIS Control 1 is the most specific: a named owner per asset, review at least bi-annually, and unauthorised assets addressed weekly.
Leaver return evidence and serial-level disposal certificates are the artefacts most likely to be sampled and most likely to be missing.
A custody register and a network discovery tool see different gaps; reconcile them before the audit, not during it.

Frequently asked questions

Does SOC 2 require an asset inventory?

SOC 2 does not have a criterion titled 'asset inventory', but the AICPA Trust Services Criteria include points of focus under CC6.1 (identify, inventory, classify and manage information assets) and CC3.2 (identify information assets including physical devices). CC6.5 covers disposal and CC6.7 covers mobile devices and removable media. In practice auditors expect a current inventory with owners as the foundation for testing those criteria.

What is ISO 27001 Annex A 5.9?

Annex A 5.9 in ISO/IEC 27001:2022 is 'Inventory of information and other associated assets'. It requires an inventory of information and associated assets, including owners, to be developed and maintained. It merged two 2013 controls, A.8.1.1 inventory of assets and A.8.1.2 ownership of assets. For hardware, auditors look for a current list with a named owner per device and evidence it is kept up to date.

What evidence do auditors want for returned equipment from leavers?

For a sample of leavers, auditors typically ask for the list of assets each person held, the date each was returned, its condition and who received it, alongside the access revocation record. This supports ISO 27001 control 5.11 return of assets and SOC 2 CC6.5. The evidence is easy if devices were issued against named people; it is very hard to reconstruct after the fact.

What should a disposal or data destruction certificate include?

NIST SP 800-88 Revision 2 recommends a certificate per item recording manufacturer, model, serial and asset number, media type and source, the sanitisation method (clear, purge or destroy) and technique, the tool and version, the verification method, and the name, title, date, location, contact details and signature of the person verifying. A bulk certificate without serial numbers cannot prove what happened to a specific device.

How often should a hardware asset inventory be reviewed?

CIS Controls v8.1 Safeguard 1.1 says to review and update the enterprise asset inventory bi-annually, or more frequently, and Safeguard 1.2 says unauthorised assets should be addressed weekly. ISO 27001 and SOC 2 do not set a fixed interval; they expect you to define one in policy and show evidence you followed it. A dated review record is what auditors ask to see.

Is an MDM or network discovery tool enough for ISO 27001 asset inventory?

Usually not on its own. Discovery and MDM tools see devices that are enrolled or connected, which misses spares in storage, devices in transit, broken units and laptops a leaver never returned. ISO 27001 5.9 also expects owners, and 5.11 expects return evidence, which discovery tools do not record. Most organisations reconcile a custody register against their MDM or discovery data.

More from the blog

Fixed Asset Register Requirements: US GAAP, IFRS and UK FRS 102 Equipment Management for Schools and Colleges: A Practical Guide Asset Management for Law, Accounting and Consulting Firms Repair or Replace Equipment? A Decision Framework With Real Inputs