Asset inventories have not been updated in the past 24 months

Asset inventories have not been updated in the past 24 months

Context and Guidance: Building on ASSET-AP2, asset inventories are used as a source of truth to support other business activities, such as:

• Configuration and change management
• Threat and vulnerability management
• Backup management
• Service continuity and disaster recovery.

Given the reliance on asset inventories, it is important that they are periodically updated to reflect the changing organisational environment. According to the Australian Cybersecurity Centre (ACSC), asset inventories should be updated at least every 24 months, however a higher frequency is recommended.