Which of the fallowing statements is MOST accurate regarding information assets?

ISO 27001 does not prescribe or mandate which specific information assets an organization must have; instead, it requires organizations to identify and manage their own assets based on their unique context and risk environment.

Information assets are broadly defined as any information that holds value to an organization, regardless of format or medium - including digital data, physical records, intellectual property, and proprietary processes. This definition aligns with ISO 27001 and general information security management principles, which emphasize protecting all valuable information rather than limiting scope to specific types. Accurately identifying what constitutes an information asset is foundational to building an asset register and conducting risk assessments.

While building an information asset register can be time-consuming, stating it is 'resource-intensive' is not the MOST accurate or defining statement about information assets themselves - it describes a process characteristic rather than the nature of information assets.

This is factually incorrect; an information assets inventory is a critical prerequisite for risk assessment, as you cannot assess risks to assets you have not identified and catalogued.