The following asset types should be included when classifying assets:
- People - employees, contractors, vendors, and external service provider personnel;
- Technology - servers, client computers, mobile devices, network appliances (e.g., firewalls, switches, APs, and routers), VoIP devices, applications, virtual machines, and database systems;
- Facilities - physical office locations, satellite offices, server rooms, datacenters, manufacturing plants, and secured rooms; and
- External Service Provider ("ESP") - external people, technology, or facilities that the organization utilizes including Cloud Service Providers, Managed Service Providers, Managed Security Service Providers, Cybersecurity-as-a-Service Providers.