# REG-03: INFORMATION ASSET REGISTER
## JOHN THOMAS FINTECH PRIVATE LIMITED
**CIN:** U62099KL2026PTC106017 | **Doc ID:** JT-ISMS-REG-003  
**Version:** 1.0 | **Effective Date:** 14-Oct-2026 | **Review Cycle:** Semi-Annual  
**ISO/IEC 27001:2022 Controls:** 5.9 (Inventory of assets), 5.12 (Classification of information)

---

## 1. Asset Inventory & Classification Table

| Asset ID | Asset Name & Category | Description & Location | Asset Owner | Custodian | Classification | Confidentiality | Integrity | Availability | Safeguards / Controls Applied |
|:---|:---|:---|:---|:---|:---:|:---:|:---:|:---:|:---|
| **AST-01** | Production PostgreSQL / Aurora DB | Core transactional database hosting ledger, customer accounts, and settlement logs (AWS Mumbai `ap-south-1`) | Lead Architect | DevOps Lead | **Restricted (L4)** | High | High | High | Multi-AZ, AES-256 KMS encryption at rest, PITR snapshots, zero direct public IP access |
| **AST-02** | Master Cryptographic KMS Keys | AWS KMS Customer Managed Keys (CMKs) used for data encryption and tokenization | CISO | DevOps Lead | **Restricted (L4)** | High | High | High | Hardware HSM backing, annual rotation, strict IAM key policy |
| **AST-03** | Fintech Source Code Repositories | Proprietary software application code, algorithms, and microservice definitions (GitHub Enterprise) | Lead Architect | DevOps / Tech Leads | **Confidential (L3)** | High | High | High | Branch protection, mandatory PR peer review, 2FA, daily backup clone |
| **AST-04** | Cloud Infrastructure VPCs & Clusters | AWS / GCP Production and Staging VPCs, Kubernetes clusters, ECS tasks, ALB load balancers | DevOps Lead | DevOps Team | **Confidential (L3)** | High | High | High | Terraform IaC, Security Groups, WAF, GuardDuty monitoring, CIS Benchmark hardened |
| **AST-05** | API Gateway & Integration Endpoints | Public and private REST/GraphQL APIs interfacing with partner financial institutions and clients | Lead Architect | Backend Leads | **Confidential (L3)** | High | High | High | TLS 1.3, rate limiting, OAuth 2.0 / JWT validation, OWASP API Top 10 hardening |
| **AST-06** | Developer Endpoints (MacBooks / Laptops) | Company-managed laptops utilized by software engineers and operations personnel (Kochi Office / Remote) | IT Ops Lead | Individual Assignees | **Confidential (L3)** | Med | High | Med | FileVault/BitLocker full disk encryption, MDM remote wipe, EDR antivirus, screen lock |
| **AST-07** | Office Networking Hardware | Ubiquiti UniFi router, managed PoE switch, WPA3 Wi-Fi access points, CCTV NVR (Kochi Office) | IT Admin | Office Manager | **Internal (L2)** | Med | High | High | Locked server rack, WPA3 Enterprise, isolated VLANs for corporate vs guest, UPS backup |
| **AST-08** | Corporate Identity & Email Accounts | Google Workspace / SSO accounts, administrative directories, and corporate email systems | CISO | IT Ops Lead | **Confidential (L3)** | High | High | High | Mandatory MFA, DMARC/DKIM/SPF enforcement, session inactivity timeouts |
| **AST-09** | Corporate Legal & Statutory Documents | Incorporation Certificate, MOA, AOA, PAN, GSTIN, Board resolutions, contracts (Physical & Cloud Drive) | Managing Director | Company Secretary | **Confidential (L3)** | High | High | Med | Encrypted cloud drive, physical copies locked in executive safe |
| **AST-10** | Continuous Integration (CI/CD) Pipelines | GitHub Actions workflows and deployment runners automating testing and cloud deployment | DevOps Lead | DevOps Team | **Confidential (L3)** | High | High | High | Ephemeral runners, secret masking, least-privilege AWS IAM OIDC roles |

---

## 2. Review & Maintenance Sign-off
Maintained by CISO. Verified during each internal audit cycle.