ID.AM Asset Management

Statement

Inventories of hardware managed by the organization are maintained

Guidance

Maintain inventories for all types of hardware, including IT, IoT, OT, and mobile devices

Guidance

Constantly monitor networks to detect new hardware and automatically update inventories

Statement

Inventories of software, services, and systems managed by the organization are maintained

Guidance

Maintain inventories for all types of software and services, including commercial-off-the-shelf, open-source, custom applications, API services, and cloud-based applications and services

Guidance

Constantly monitor all platforms, including containers and virtual machines, for software and service inventory changes

Guidance

Maintain an inventory of the organization's systems

Statement

Representations of the organization's authorized network communication and internal and external network data flows are maintained

Guidance

Maintain baselines of communication and data flows within the organization's wired and wireless networks

Guidance

Maintain baselines of communication and data flows between the organization and third parties

Guidance

Maintain baselines of communication and data flows for the organization's infrastructure-as-a-service (IaaS) usage

Guidance

Maintain documentation of expected network ports, protocols, and services that are typically used among authorized systems

Statement

Inventories of services provided by suppliers are maintained

Guidance

Inventory all external services used by the organization, including third-party infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS), and software-as-a-service (SaaS) offerings; APIs; and other externally hosted application services

Guidance

Update the inventory when a new external service is going to be utilized to ensure adequate cybersecurity risk management monitoring of the organization's use of that service

Statement

Assets are prioritized based on classification, criticality, resources, and impact on the mission

Guidance

Define criteria for prioritizing each class of assets

Guidance

Apply the prioritization criteria to assets

Guidance

Track the asset priorities and update them periodically or when significant changes to the organization occur

Statement

Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established

Statement

Inventories of data and corresponding metadata for designated data types are maintained

Guidance

Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)

Guidance

Continuously discover and analyze ad hoc data to identify new instances of designated data types

Guidance

Assign data classifications to designated data types through tags or labels

Guidance

Track the provenance, data owner, and geolocation of each instance of designated data types

Statement

Systems, hardware, software, services, and data are managed throughout their life cycles

Guidance

Integrate cybersecurity considerations throughout the life cycles of systems, hardware, software, and services

Guidance

Integrate cybersecurity considerations into product life cycles

Guidance

Identify unofficial uses of technology to meet mission objectives (i.e., shadow IT)

Guidance

Periodically identify redundant systems, hardware, software, and services that unnecessarily increase the organization's attack surface

Guidance

Properly configure and secure systems, hardware, software, and services prior to their deployment in production

Guidance

Update inventories when systems, hardware, software, and services are moved or transferred within the organization

Guidance

Securely destroy stored data based on the organization's data retention policy using the prescribed destruction method, and keep and manage a record of the destructions

Guidance

Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement

Guidance

Offer methods for destroying paper, storage media, and other physical forms of data storage