12.4.2 The granularity of the inventory of the assets shall be at a level appropriate for the needs of the …

Requirement

The granularity of the inventory of the assets shall be at a level appropriate for the needs of the relevant entities. The inventory shall include the following: (a) the list of operations and services and their description, (b) the list of network and information systems and other associated assets supporting the relevant entities’ operations and services.

Guidance

• Consider adding one or more of the following to the inventory (indicative, non-exhaustive list):
  • asset unique ID,
  • asset type, for example software including virtual machines (version), hardware (operating system / firmware), services, supporting utilities, facilities, heating, ventilation and air conditioning (HVAC) systems, personnel and physical records,
  • asset owner and contact information,
  • operational unit responsible for the asset, either internal department name or external provider name (106),
  • asset description,
  • asset location,
  • date of asset’s last update/patch,
  • asset classification consistent with the risk assessment,
  • type of information and its classification processed in the basset,
  • asset end of life, where applicable,
  • relation to other assets and
  • logging requirements.

Examples of evidence

• Configuration of the asset inventory tool, if any.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -