Does your organization maintain comprehensive inventories of all hardware assets, including IT equipment, IoT devices, operational technology (OT), and mobile devices?
Explanation
A complete hardware inventory is fundamental to effective security management as it provides visibility into all assets that need protection and could represent potential attack vectors. This inventory should include details such as device type, location, owner, operating system, network information, and security status for all IT equipment, IoT devices, operational technology systems, and mobile devices.
Acceptable evidence would include an up-to-date asset management database or inventory spreadsheet showing all hardware assets with relevant attributes, screenshots of an asset management system, or documentation of the process used to maintain and update the hardware inventory.
Implementation Example
Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices
ID: ID.AM-01.120
Context
- Function
- ID: IDENTIFY
- Category
- ID.AM: Asset Management
- Sub-Category
- Inventories of hardware managed by the organization are maintained
Related questions
- Does your organization implement automated network monitoring to detect new hardware and update inventory records in real-time?
- Does your organization maintain a comprehensive inventory of all software and services, including commercial, open-source, custom, API, and cloud-based applications?
- Does your organization implement continuous monitoring for software and service inventory changes across all platforms, including containers and virtual machines?
- Does your organization maintain a comprehensive inventory of all systems within your environment?
- Does your organization maintain documented baselines of expected network communication patterns and data flows for both wired and wireless networks?
- Does your organization document and maintain baselines of expected communication patterns and data flows with third parties?