Does your organization have a formal process to periodically identify and remove redundant systems, hardware, software, and services that could unnecessarily increase your attack surface?

Redundant or unnecessary systems and components expand your organization's attack surface, creating additional entry points for attackers while increasing maintenance overhead. These might include legacy systems no longer in active use, duplicate software installations, orphaned cloud resources, or services running without business justification. Evidence of fulfillment could include a documented inventory management process with timestamps of regular reviews, decommissioning procedures, and records of systems/software that have been identified as redundant and subsequently removed or consolidated. Screenshots of asset management tools showing regular cleanup activities would also serve as supporting evidence.