Does your organization update asset inventories when systems, hardware, software, and services are moved or transferred internally?
Explanation
Maintaining accurate asset inventories requires updating records whenever assets change location or ownership within the organization.
This includes documenting when workstations are reassigned to different departments, when servers are relocated to different data centers, or when software licenses are transferred between business units.
Without these updates, organizations risk losing track of critical assets, creating security blind spots, and making inaccurate decisions based on outdated information.
Evidence of compliance could include screenshots of asset management system entries showing transfer history fields, documented procedures for updating inventory during transfers, change management records that include inventory update steps, or audit logs showing inventory modifications following internal transfers.
Implementation Example
Update inventories when systems, hardware, software, and services are moved or transferred within the organization
ID: ID.AM-08.143
Context
- Function
- ID: IDENTIFY
- Category
- ID.AM: Asset Management
- Sub-Category
- Systems, hardware, software, services, and data are managed throughout their life cycles
Related questions
- Does your organization maintain comprehensive inventories of all hardware assets, including IT equipment, IoT devices, operational technology (OT), and mobile devices?
- Does your organization implement automated network monitoring to detect new hardware and update inventory records in real-time?
- Does your organization maintain a comprehensive inventory of all software and services, including commercial, open-source, custom, API, and cloud-based applications?
- Does your organization implement continuous monitoring for software and service inventory changes across all platforms, including containers and virtual machines?
- Does your organization maintain a comprehensive inventory of all systems within your environment?
- Does your organization maintain documented baselines of expected network communication patterns and data flows for both wired and wireless networks?