Manajemen Aset
Mengidentifikasi dan mengelola perangkat keras, perangkat lunak, data, dan sistem.
Manajemen Aset didefinisikan oleh hasil-hasil NIST CSF 2.0 ID.AM-01 (Inventories of hardware managed by the organization are maintained); ID.AM-02 (Inventories of software, services, and systems managed by the organization are maintained); ID.AM-04 (Inventories of services provided by suppliers are maintained); ID.AM-08 (Systems, hardware, software, services, and data are managed throughout their life cycles). Crosswalk Dipetakan melalui crosswalk yang dipublikasikan dalam ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA dan NIS2. Editorial Dipetakan secara editorial dalam SOC 2, GDPR, Essential Eight, DORA, CPS 234 dan Cyber Essentials.
| Kerangka kerja | Persyaratan | Judul | Tautan | Sumber / alasan |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-01ID.AM-02ID.AM-04ID.AM-08 | Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained; Inventories of services provided by suppliers are maintained… | Definisi topik | ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-08 |
| ISO 27001 | A.5.9A.5.11A.7.14 | Inventory of information and other associated assets; Return of assets; Secure disposal or re-use of equipment | Crosswalk | A.5.9: via ID.AM-01; ID.AM-02; ID.AM-08; NIST 800-53 map: CM-8 A.5.11: via ID.AM-08 A.7.14: via ID.AM-08 |
| CIS v8.1 | CIS 1.1CIS 2.1CIS 1.2CIS 1.3CIS 1.4CIS 1.5CIS 2.3CIS 2.4CIS 16.4 | Establish and Maintain Detailed Enterprise Asset Inventory; Establish and Maintain a Software Inventory; Address Unauthorized Assets… | Crosswalk | CIS 1.1: via ID.AM-01; ID.AM-08 CIS 2.1: via ID.AM-02 CIS 1.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): deal with unauthorised assets found in the inventory. CIS 1.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): active discovery keeps the asset inventory complete. CIS 1.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): DHCP logs update the asset inventory. CIS 1.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): passive discovery keeps the asset inventory complete. CIS 2.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): deal with unauthorised software found in the inventory. CIS 2.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated tools keep the software inventory current. CIS 16.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): an inventory of third-party software components. |
| SOC 2 | CC6.1 | Logical access security over information assets | Editorial | CC6.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 12.5.16.3.2 | Inventory of in-scope system components; Inventory of custom software and its components | Crosswalk | 12.5.1: via ID.AM-01; ID.AM-02 6.3.2: via ID.AM-02 |
| CMMC | CM.L2-3.4.1 | System Baselining | Crosswalk | CM.L2-3.4.1: via 800-171r2 Appendix D → CM-8 |
| 800-53 | CM-8PM-5 | System Component Inventory; System Inventory | Crosswalk | CM-8: via ID.AM-01; ID.AM-02 PM-5: via ID.AM-01; ID.AM-02 |
| HIPAA | §164.310(d)§164.310(d)(2)(iii) | Device and Media Controls; Accountability | Crosswalk | §164.310(d): via NIST HIPAA map: CM-8 §164.310(d)(2)(iii): via NIST HIPAA map: CM-8 |
| GDPR | Art.30(1) | Records of processing activities | Editorial | Art.30(1): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 12.4 | Asset inventory | Crosswalk | 12.4: via ID.AM-01; ID.AM-02; ID.AM-04; ID.AM-08; ENISA ISO map: A.5.9 |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | Editorial | ISM-1807: ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.8(1)Art.8(4)Art.8(6) | Identification; Identification; Identification | Editorial | Art.8(1): Identify, classify and document ICT-supported business functions and the assets that support them. Art.8(4): Identify all information and ICT assets, map the critical ones and their configuration and interdependencies. Art.8(6): Maintain asset inventories and update them on every major change. |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | Editorial | Para 20: The section on information asset identification and classification: identify and classify information assets, including those managed by third parties. |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | CE 3: All in-scope software must be licensed and supported, and unsupported software removed, which needs a software inventory. |
Definisi topik Hasil CSF 2.0 yang mendefinisikan topik ini · Crosswalk setidaknya satu pilihan didukung crosswalk yang dipublikasikan · Editorial Penilaian ControlMapping, beserta alasannya · belum dipetakan, hanya berbagi hasil CSF untuk topik ini · Tidak ada pemetaan dalam data kami belum ada yang dipetakan dalam data kami; sering kali pekerjaan baru, tetapi periksa catatan cakupannya. Metodologi.
ID dan judul persyaratan ditampilkan sebagaimana diterbitkan masing-masing framework, dalam bahasa Inggris.
Pemetaan salah atau belum ada? Laporkan
Tentang Manajemen Aset
Manajemen aset yang komprehensif memberikan visibilitas yang diperlukan untuk melindungi apa yang Anda miliki dengan menjaga inventaris yang akurat atas perangkat keras, aplikasi perangkat lunak, penyimpanan data, dan layanan cloud. Tanpa inventaris aset yang lengkap, organisasi tidak dapat menerapkan kontrol keamanan secara efektif, mendeteksi perangkat yang tidak sah, atau memastikan cakupan patch. Implementasinya biasanya melibatkan alat penemuan otomatis, basis data manajemen konfigurasi (CMDB), dan proses untuk melacak siklus hidup aset mulai dari pengadaan hingga penghentian penggunaan.