Asset Discovery
What is Asset Discovery?
The process of identifying and cataloging all hardware, software, and data assets within an organization's IT environment to maintain an accurate inventory.
Terms that appear alongside asset discovery
Each of these is named in at least one of the same controls as asset discovery. The number is how many controls name both.
- vulnerability 3 shared controls
- asset inventory 2 shared controls
- vulnerability database 2 shared controls
- vulnerability scanning 2 shared controls
Frameworks that govern asset discovery
What the standards actually require on asset discovery
Requirements naming asset discovery across 6 standards, quoted from the control text.
An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.
acsc-essential-eight::E8-PATCHAPP-ISM-1807 · Patch applications (ISM-1807): An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities →An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.
ISM-1807 · Fortnightly automated asset discovery →Run a passive discovery tool that finds the assets attached to the enterprise network. Examine its scan results and apply them to the asset register no less often than weekly.
CIS-1.5 · Use a Passive Asset Discovery Tool →Add passive discovery, which listens to network traffic to spot connected devices, and use its findings to bring the asset register up to date weekly or more often.
cis-controls-v8-1::1.5 · Use a Passive Asset Discovery Tool →Where in-house capability is limited, third parties can assist, including active penetration testing of critical OT and IT to check actual against intended defence (simulating IT attacks, social engineering or physical intrusion), though for OT this may suit o...
BIMCO-6.3 · Third party risk assessments →Management tracks and monitors all hardware assets whether or not connected to the network through an accurate hardware inventory, identifies unauthorised assets and decides whether to remove, isolate or add them, evaluates how an unauthorised device gained ac...
ffiec-it-examination-handbook::AIO-V.A · V.A Hardware (Architecture, Infrastructure, and Operations) →Questions people ask about asset discovery
What is Asset Discovery?
Why is Asset Discovery important for compliance?
Which compliance frameworks address Asset Discovery?
Where can I learn more about Asset Discovery?
See how Asset Discovery applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.