Gestione degli asset
Identificare e gestire hardware, software, dati e sistemi.
Gestione degli asset è definito dagli esiti ID.AM-01 (Inventories of hardware managed by the organization are maintained); ID.AM-02 (Inventories of software, services, and systems managed by the organization are maintained); ID.AM-04 (Inventories of services provided by suppliers are maintained); ID.AM-08 (Systems, hardware, software, services, and data are managed throughout their life cycles) di NIST CSF 2.0. Crosswalk Mappato tramite un crosswalk pubblicato in ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA e NIS2. Redazione Mappato in modo editoriale in SOC 2, GDPR, Essential Eight, DORA, CPS 234 e Cyber Essentials.
| Framework | Requisito | Titolo | Collegamento | Fonte / motivo |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-01ID.AM-02ID.AM-04ID.AM-08 | Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained; Inventories of services provided by suppliers are maintained… | Definizione dell'argomento | ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-08 |
| ISO 27001 | A.5.9A.5.11A.7.14 | Inventory of information and other associated assets; Return of assets; Secure disposal or re-use of equipment | Crosswalk | A.5.9: via ID.AM-01; ID.AM-02; ID.AM-08; NIST 800-53 map: CM-8 A.5.11: via ID.AM-08 A.7.14: via ID.AM-08 |
| CIS v8.1 | CIS 1.1CIS 2.1CIS 1.2CIS 1.3CIS 1.4CIS 1.5CIS 2.3CIS 2.4CIS 16.4 | Establish and Maintain Detailed Enterprise Asset Inventory; Establish and Maintain a Software Inventory; Address Unauthorized Assets… | Crosswalk | CIS 1.1: via ID.AM-01; ID.AM-08 CIS 2.1: via ID.AM-02 CIS 1.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): deal with unauthorised assets found in the inventory. CIS 1.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): active discovery keeps the asset inventory complete. CIS 1.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): DHCP logs update the asset inventory. CIS 1.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): passive discovery keeps the asset inventory complete. CIS 2.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): deal with unauthorised software found in the inventory. CIS 2.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): automated tools keep the software inventory current. CIS 16.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): an inventory of third-party software components. |
| SOC 2 | CC6.1 | Logical access security over information assets | Redazione | CC6.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 12.5.16.3.2 | Inventory of in-scope system components; Inventory of custom software and its components | Crosswalk | 12.5.1: via ID.AM-01; ID.AM-02 6.3.2: via ID.AM-02 |
| CMMC | CM.L2-3.4.1 | System Baselining | Crosswalk | CM.L2-3.4.1: via 800-171r2 Appendix D → CM-8 |
| 800-53 | CM-8PM-5 | System Component Inventory; System Inventory | Crosswalk | CM-8: via ID.AM-01; ID.AM-02 PM-5: via ID.AM-01; ID.AM-02 |
| HIPAA | §164.310(d)§164.310(d)(2)(iii) | Device and Media Controls; Accountability | Crosswalk | §164.310(d): via NIST HIPAA map: CM-8 §164.310(d)(2)(iii): via NIST HIPAA map: CM-8 |
| GDPR | Art.30(1) | Records of processing activities | Redazione | Art.30(1): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 12.4 | Asset inventory | Crosswalk | 12.4: via ID.AM-01; ID.AM-02; ID.AM-04; ID.AM-08; ENISA ISO map: A.5.9 |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | Redazione | ISM-1807: ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.8(1)Art.8(4)Art.8(6) | Identification; Identification; Identification | Redazione | Art.8(1): Identify, classify and document ICT-supported business functions and the assets that support them. Art.8(4): Identify all information and ICT assets, map the critical ones and their configuration and interdependencies. Art.8(6): Maintain asset inventories and update them on every major change. |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | Redazione | Para 20: The section on information asset identification and classification: identify and classify information assets, including those managed by third parties. |
| Cyber Essentials | CE 3 | Security Update Management | Redazione | CE 3: All in-scope software must be licensed and supported, and unsupported software removed, which needs a software inventory. |
Definizione dell'argomento Risultati CSF 2.0 che definiscono questo tema · Crosswalk almeno una scelta supportata da una tabella di corrispondenza pubblicata · Redazione Giudizio di ControlMapping, con la motivazione · non mappato, condivide solo gli esiti CSF di questo argomento · Nessuna mappatura nei nostri dati nessuna mappatura nei nostri dati; spesso si tratta di lavoro nuovo, ma verifica le note sulla copertura. Metodologia.
ID e titoli dei requisiti sono riportati come ciascun framework li pubblica, in inglese.
Mappatura errata o mancante? Segnalalo
Informazioni su Gestione degli asset
Una gestione completa degli asset garantisce la visibilità necessaria per proteggere ciò che l'organizzazione possiede, mantenendo inventari accurati di dispositivi hardware, applicazioni software, archivi di dati e servizi cloud. Senza un inventario completo degli asset, le organizzazioni non possono applicare efficacemente i controlli di sicurezza, rilevare dispositivi non autorizzati o garantire la copertura delle patch. L'implementazione prevede in genere strumenti di discovery automatizzati, database di gestione della configurazione (CMDB) e processi per tracciare il ciclo di vita degli asset, dall'acquisto fino alla dismissione.