Asset Inventory
What is Asset Inventory?
A comprehensive and up-to-date register of all hardware, software, data, and network resources owned or managed by an organisation. Required by most security frameworks including CIS Controls and ISO 27001.
Terms that appear alongside asset inventory
Each of these is named in at least one of the same controls as asset inventory. The number is how many controls name both.
- asset management 13 shared controls
- risk assessment 9 shared controls
- nist 9 shared controls
- cybersecurity 8 shared controls
- encryption 7 shared controls
- ransomware 6 shared controls
- vulnerability 5 shared controls
- governance 5 shared controls
Frameworks that govern asset inventory
What the standards actually require on asset inventory
Requirements naming asset inventory across 6 standards, quoted from the control text.
Risk identification draws on asset inventory and prioritisation information from the ASSET domain, such as IT and OT end of support, single points of failure and information assets' exposure to disclosure, tampering or destruction.
australian-energy-sector-cyber-security-framework-aescsf::RISK-2h · RISK-2h: Risk identification uses asset inventory and priority data →Lists hardware (name, maker, model, purpose, physical interfaces, system software and its version and patch level, supported protocols) and software (host component, maker, model, purpose, version).
iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-3.1.1 · E27 3.1.1 CBS asset inventory →The plan must require an IAC cyber asset management plan for tracking and reporting physical and virtual IAC cyber assets, consistent criteria for identifying physical assets, virtual assets treated as separate assets from their hosts, a minimum attribute set...
api-1164::ID.AM-1 · ID.AM-1 IAC cyber asset inventory with consistent identification, minimum attributes and zone membership →Feed logging from every DHCP server, or from IP address management tools, into updates of the enterprise asset register. Examine these logs and apply them to the register at least weekly.
CIS-1.4 · Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory →Feed the asset register from DHCP server logs or IP address management tooling, examining those logs and updating the register at least once a week. Implementation Groups: IG2 and IG3 (not in the IG1 baseline; applies from IG2 upward). Asset type: Devices.
cis-controls-v8-1::1.4 · Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory →Maintain an inventory of ICS assets, categorise asset criticality, identify security risks, determine potential impact, tailor and implement security controls, and monitor and adjust.
CISA-ICS-DID-22 · Asset Inventory and Risk Characterization →Questions people ask about asset inventory
What is Asset Inventory?
Why is Asset Inventory important for compliance?
Which compliance frameworks address Asset Inventory?
Where can I learn more about Asset Inventory?
See how Asset Inventory applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.