Does your organization maintain a comprehensive inventory of all software and services, including commercial, open-source, custom, API, and cloud-based applications?

A complete software and service inventory is fundamental to effective security management as it enables organizations to track what needs to be patched, monitored, and secured. Without knowing what software and services exist in your environment, it's impossible to properly secure them against vulnerabilities or ensure compliance with licensing requirements. Evidence of fulfillment could include a centralized software asset management (SAM) database or spreadsheet that lists all applications with details such as vendor, version, purpose, owner, deployment location (on-premises/cloud), licensing information, and security approval status.