ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles

Statement

Systems, hardware, software, services, and data are managed throughout their life cycles

Guidance

Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services

Guidance

Integrate cybersecurity considerations into product life cycles

Guidance

Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)

Guidance

Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface

Guidance

Properly configure and secure systems, hardware, software, and services prior to their deployment in production

Guidance

Update inventories when systems, hardware, software, and services are moved or transferred within the organization

Guidance

Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions

Guidance

Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement

Guidance

Offer methods for destroying paper, storage media, and other physical forms of data storage

1. Overzicht

1.1 Referenties

• 6.2 Secure development life cycle
• 12.4 Asset inventory

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

3. Gerelateerde regelingen

Gekoppelde issues

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.