12.4.2 The granularity of the inventory of the assets shall be at a level appropriate for the needs of the …

Requirement

The granularity of the inventory of the assets shall be at a level appropriate for the needs of the relevant entities. The inventory shall include the following: (a) the list of operations and services and their description, (b) the list of network and information systems and other associated assets supporting the relevant entities’ operations and services.

Guidance

• Consider adding one or more of the following to the inventory (indicative, non-exhaustive list):
  • asset unique ID,
  • asset type, for example software including virtual machines (version), hardware (operating system / firmware), services, supporting utilities, facilities, heating, ventilation and air conditioning (HVAC) systems, personnel and physical records,
  • asset owner and contact information,
  • operational unit responsible for the asset, either internal department name or external provider name (106),
  • asset description,
  • asset location,
  • date of asset’s last update/patch,
  • asset classification consistent with the risk assessment,
  • type of information and its classification processed in the basset,
  • asset end of life, where applicable,
  • relation to other assets and
  • logging requirements.

Examples of evidence

• Configuration of the asset inventory tool, if any.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

3. Regolamenti relatati

Kwistjonijiet marbuta

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.