# ISO/IEC 42001:2023 A.4.3 — Data resources

- Source: https://support.icompaas.com/compliance/iso-42001-2023/a-4-3-data-resources
- Section: [Compliance](https://support.icompaas.com/compliance) › [ISO/IEC 42001:2023 (AI Management System) Annex A Controls](https://support.icompaas.com/compliance/iso-42001-2023) › Organizational controls
- Last updated: 2026-06-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**ISO/IEC 42001:2023**·Annex A `A.4.3`·medium·Component: **Organizational controls**

## What this control requires

> Data resources required for AI development, operation, and monitoring shall be identified, managed, and governed.
> 
> — ISO/IEC 42001:2023, Annex A A.4.3

### In plain English

Data resources required for AI development, operation, and monitoring shall be identified, managed, and governed. In practice, this means you can prove you manage data-level controls on a defined cadence.

## Why it matters

ISO 42001 is the first audited evidence regulators, customers and investors can ask for that you are managing AI risk. Each Annex A control is a check-box in that audit; it is also the management system enterprises are starting to require from AI vendors before an MSA can be signed.

## What an auditor looks for

An ISO 42001 auditor verifies you have an AI policy, a risk-based system of impact assessments for each AI system, lifecycle controls from data acquisition through retirement, and third-party-AI controls that pierce the vendor's wrapper to underlying model behaviour.

Within **Organizational controls**, the assessor will trace your implementation back to the catalogue reference (Annex A A.4.3) and look for objective evidence on the latest two assessment cycles.

## How to implement

#### Asset Inventory

**AWS.** AWS Config Aggregator across every account + region gives a real-time inventory; ship the daily snapshot to S3 and surface drift in Security Hub.

**Azure.** Azure Resource Graph plus Defender for Cloud's inventory blade enumerates every subscription; export to Log Analytics for retention and Workbooks for reporting.

**GCP.** Cloud Asset Inventory exports a daily feed of every resource and IAM binding; query via BigQuery and alert on appearance/disappearance.

**Endpoints.** Pipe MDM telemetry (Intune / Jamf / Workspace ONE) into your CMDB so laptops and phones are inventoried with the same rigour as cloud resources.

### Operational checklist

-   **Manage.** Document the trigger, the owner and the cadence.
-   **Monitor.** Document the trigger, the owner and the cadence.
-   **Develop.** Document the trigger, the owner and the cadence.
-   **Govern.** Document the trigger, the owner and the cadence.
-   **Scope:** data, resources.

## Evidence to collect

-   **Policy Document.** A signed and version-controlled policy / standard / procedure document.
-   **Infra Scan.** Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.

Policies and inventories should identify data resources used by AI systems, while infrastructure or platform evidence should demonstrate where those resources are stored, processed, and monitored. Focus: Data resources.

## Common pitfalls

-   Inventories that exclude SaaS, shadow IT and ephemeral cloud resources (Lambda, Cloud Run, K8s pods) miss the assets where most modern incidents start.

## Related controls in ISO/IEC 42001:2023

-   [**Annex A A.4.2** — Resources documentation](https://support.icompaas.com/compliance/iso-42001-2023/a-4-2-resources-documentation)
-   [**Annex A A.4.4** — Tooling resources](https://support.icompaas.com/compliance/iso-42001-2023/a-4-4-tooling-resources)
-   [**Annex A A.6.2.4** — Data acquisition](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-4-data-acquisition)
-   [**Annex A A.4.6** — Human resources](https://support.icompaas.com/compliance/iso-42001-2023/a-4-6-human-resources)
-   [**Annex A A.6.2.6** — Data provenance](https://support.icompaas.com/compliance/iso-42001-2023/a-6-2-6-data-provenance)
-   [**Annex A A.7.3** — Acquisition of data](https://support.icompaas.com/compliance/iso-42001-2023/a-7-3-acquisition-of-data)

## References

-   [ISO/IEC JTC 1/SC 42 — ISO/IEC 42001:2023](https://www.iso.org/standard/81230.html)
-   Catalogue identifier: `Annex A A.4.3`

Topics: governance riskdata governanceasset inventorydata lifecycle management