The IT and OT asset inventory is complete (the inventory includes all assets within the function)

This practice expands the inventory scope of ASSET-1a. Any IT and OT asset that is related to the delivery of the function should be identified and inventoried, along with its attributes. The relationship of assets to business functions should also be included to enable prioritization and development of protection and sustainment strategies. The implementation of the inventory should be proportional to the organization’s size, complexity, and risk. For example, for a small, low-complexity firm, a simple spreadsheet may be used for the inventory. For larger, more complex firms, more sophisticated methods such as dedicated asset inventory application are appropriate. Organizations may consider implementing tools for identifying what devices are connected to networks and identifying new unexpected connections. Organizations should consider the different kinds of IT and OT assets that may be within the scope of the self-evaluation, such as: · virtualized assets · regulated assets · assets managed by a third party · bring your own device (BYOD) assets · cloud assets (public, hybrid, or private service, software as a service, platform as a service, and infrastructure as a service, etc.) · mobile assets · field assets · backup, spare, and redundant assets, including dormant virtualized assets · assets reliant on specific infrastructure such as wireless networks, positioning navigation and timing services, and the Global Position System · assets that may be considered to be part of the Internet of Things or Industrial Internet of Things Inventory refers to a complete listing and is not meant to imply that a single list is required; multiple repositories, documents, or systems may be used to accomplish this practice. Where appropriate, however, organizations should consider whether inventories may be consolidated to avoid potential risks related to managing multiple repositories. Asset discovery technologies are increasing in capability and availability and may be leveraged to accomplish this practice.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ASSET-1a, ASSET-1b, ASSET-1f, ASSET-1g.