12.4 Asset inventory

Requirement

The relevant entities shall develop and maintain a complete, accurate, up-to-date and consistent inventory of their assets. They shall record changes to the entries in the inventory in a traceable manner.

Guidance

• Ensure that all assets, including hardware, software, data and services, are listed in the inventory.
• Regularly verify the accuracy of the inventory entries.
• Update the inventory promptly to reflect any changes, such as new assets, decommissioned assets or changes in asset status (section 6.4)
• Use standardised naming conventions and categorization methods to maintain consistency across the inventory.
• Make sure that inventory entries contain the data in the guidance below (sampling).
• Implement validation rules within the inventory to ensure data entered is complete and consistent.

Examples of evidence

• Documentation for the inventory of assets
• Up to date inventory of assets
• Records of reviews or history of changes.
• Records of key metrics tracked, such as the number of assets, types of assets, compliance with inventory policies and the timeliness of updates.

Requirement

The granularity of the inventory of the assets shall be at a level appropriate for the needs of the relevant entities. The inventory shall include the following: (a) the list of operations and services and their description, (b) the list of network and information systems and other associated assets supporting the relevant entities’ operations and services.

Guidance

• Consider adding one or more of the following to the inventory (indicative, non-exhaustive list):
  • asset unique ID,
  • asset type, for example software including virtual machines (version), hardware (operating system / firmware), services, supporting utilities, facilities, heating, ventilation and air conditioning (HVAC) systems, personnel and physical records,
  • asset owner and contact information,
  • operational unit responsible for the asset, either internal department name or external provider name (106),
  • asset description,
  • asset location,
  • date of asset’s last update/patch,
  • asset classification consistent with the risk assessment,
  • type of information and its classification processed in the basset,
  • asset end of life, where applicable,
  • relation to other assets and
  • logging requirements.

Examples of evidence

• Configuration of the asset inventory tool, if any.

Requirement

The relevant entities shall regularly review and update the inventory and their assets and document the history of changes.

Guidance

• Conduct regular reviews to verify the accuracy and completeness of the inventory.
• Maintain history of changes.

Examples of evidence

• Up-to-date inventory of assets including history of changes.
• Regular reports generated on inventory status, changes and audit findings.

Tips: guidance

• Use tools that support the comprehensive tracking and management of assets.
• Ideally, consider the use of tools for automated discovery and asset tracking to continuously discover, categorize, and monitor both on-premises and cloud assets, ensuring comprehensive, up-to-date visibility and security. Alternatively, consider manual update procedures.
• Configure the chosen tool to capture the defined attributes and categories, ensuring it supports relevant functionalities such as tagging, searching and reporting.
• Set up automated alerts for missing or incomplete data, discrepancies and anomalies detected in the inventory.

Tips: examples of evidence

• Configuration settings of the asset management tool.