What counts as an information asset?

An information asset is any system, application, database, physical location, or process that stores, processes, or transmits personal data or sensitive information. Your Information Asset Register (IAR) in Folelse provides a complete inventory of these assets.

Examples of information assets

• Clinical systems — EMIS Web, SystmOne, Lorenzo, Cerner Millennium.
• HR systems — Payroll software, workforce management tools.
• Email systems — Microsoft 365, Google Workspace.
• Shared drives — SharePoint, OneDrive, network file servers.
• Third-party SaaS platforms — CRM systems, finance software, case management tools.
• Physical assets — filing cabinets containing paper records, archived boxes.
• Portable media — USB drives, encrypted laptops used to transfer data.

NHS sensitivity levels

NHS organisations classify assets using the NHS Information Asset sensitivity categories:

• Level 1 — Publicly available information.
• Level 2 — Internal information, limited impact if disclosed.
• Level 3 — Sensitive information, significant impact if disclosed (PID, business-sensitive).
• Level 4 — Highly sensitive, severe impact if disclosed (classified, child protection).