IT and OT assets that are important to the delivery of the function are inventoried, at least in an ad hoc manner

Assets derive their value and importance through their association with the aspects of the function's operations that they support. Identifying and inventorying high-value IT and OT assets helps enable selection and application of appropriate controls. At MIL1, the inventory may be produced in an ad hoc manner. Organizations should consider the different kinds of IT and OT assets that may be within the scope of the self-evaluation, such as: · virtualized assets · regulated assets · assets managed by a third party · software · bring your own device (BYOD) assets · cloud assets (public, hybrid, or private service, software as a service, platform as a service, and infrastructure as a service, etc.) · mobile assets · field assets · assets connected through different networks or communications technologies (e.g., telephone modem, cellular) · network and communications assets · backup, spare, and redundant assets, including dormant virtualized assets · non-operational assets, assets undergoing repair, assets undergoing maintenance · assets reliant on specific infrastructure such as wireless networks, positioning navigation and timing services, and the Global Position System · assets that may be considered to be part of the Internet of things or industrial Internet of things · assets that have the potential to be untracked, unclaimed, or otherwise overlooked, such as legacy assets, communications equipment, and assets supporting multiple groups An inventory is not meant to imply that a single list is required; multiple repositories, documents, or systems may be used to accomplish this practice. Where appropriate, however, organizations should consider whether inventories may be consolidated to avoid potential risks related to managing multiple repositories.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ASSET-1a, ASSET-1b, ASSET-1f, ASSET-1g.