CIS asset management policy template (Control 1) guide

What a CIS enterprise asset management policy template must cover

A customer, contract or regulator asking for CIS Control 1 evidence usually wants to see a written policy first, and that policy must cover three things: the Safeguard 1.1 inventory fields, a review of the inventory at least twice a year, and a process run at least weekly for unauthorized assets under Safeguard 1.2. CIS's free IG1 policy template for Control 1 is built around those Safeguards, so it is the natural starting point, but it is a template, not a finished policy. The organization writes it, adapts it to its own estate, approves it and owns it. An implementation partner can help draft and configure the supporting systems, but the policy's commitments are the organization's to make and keep.

The assessment specification does not score the document. For Safeguard 1.1 it checks whether an inventory exists and was last updated within six months, then compares recorded assets against discovered assets for accuracy, scores the completeness of detailed records, and reviews the inventory procedures manually. A policy that promises a twice-yearly review will not pass if the inventory it describes is stale or missing the owner, department, approval status or addresses it names. Before finalizing the wording, confirm which systems actually hold the inventory, who updates it, and whether the policy's review cadence matches the cadence the team can sustain.

The right answer depends on estate size and asset mix. A small office with a few laptops and one cloud tenant can keep a single register and check it by hand. A larger estate with virtual servers, remote endpoints, mobile devices and IoT equipment needs discovery tooling, a clear rule for which assets count as enterprise assets, and a named person who acts on the weekly unauthorized-asset report. Organizations with cloud workloads or unmanaged devices that regularly connect should decide, in writing, how those assets are inventoried before they are scored. Ask any prospective assessor or partner to walk through a sample of the inventory against the policy wording, since that exercise shows the gaps faster than reading either document alone.

Which parts of the policy map to which Safeguards

This area defines what the inventory must cover, and it traces directly to Safeguard 1.1. The Safeguard asks for an accurate, current inventory of every enterprise asset able to store or process data. Your policy should name the asset types in scope: end-user devices (including mobile), network devices, IoT devices and servers. It should also state that these assets count whether they sit on premises, run as virtual machines, operate remotely or live in the cloud.

End-user and mobile devices: Laptops, desktops and phones that handle enterprise data, including personally owned devices used for work.
Network and IoT devices: Routers, switches, firewalls, printers and sensors that connect to the network.
Servers and virtual assets: Physical servers, virtual machines and container hosts, including those in cloud accounts.
Assets outside enterprise control: Devices that regularly connect but are not enterprise controlled, which the Safeguard expressly includes.
Review cadence: The Safeguard requires review at least twice a year, so the policy should set that minimum.

Check that your scope statement matches what your discovery tools can actually see, and confirm with your auditor how they will test completeness against your environment.

How the assessment specification scores the Safeguard 1.1 inventory

The CIS Controls Assessment Specification does not score an inventory on whether it exists alone. It checks freshness first, then measures how closely the inventory matches discovered assets, how complete each record is, and how the inventory is governed. Each card below covers one of those checks and what to confirm before an assessor arrives.

The six-month staleness trap

The CAS scores Safeguard 1.1 as failing (0) when no inventory is provided or when it was last updated more than six months ago. A large, accurate inventory that has not been touched for seven months still fails. Set a recurring update cadence that is shorter than the six-month limit, and record the date of each update so an assessor can see it without asking. Confirm with the CAS directly how it establishes the last-update date for your evidence.

Accuracy against discovered assets

Where the inventory is current, the CAS reports an accuracy score by comparing recorded assets with assets the discovery process actually finds on the network. Records for retired laptops, or devices that were never recorded, both lower the score. Compare your inventory against output from active, DHCP or passive discovery tools before the assessment, and document the reconciliation. Confirm with the CAS how it defines the discovery source and the comparison window.

Completeness of detailed records

The CAS also scores completeness, meaning how many of the fields Safeguard 1.1 expects are filled in for each asset. These include network address where static, hardware address, machine name, asset owner, department and whether the asset is approved to connect. A record with only a serial number and a location is a weak result. Review a sample of records against this field list and fill gaps for owner and approval status first, since those drive accountability. Confirm the field weighting and scoring formula in the CAS.

Manual review of inventory procedures

Automated metrics do not cover everything, so the CAS includes a manual review of the procedures behind the inventory. An assessor will look for a written process that says who maintains the inventory, how often it is reviewed, how new assets are added and how assets are retired. A policy that names the process but no owner, or a procedure that no one follows, will not satisfy this review. Keep the procedure, its approval record and the review history in one place. Confirm with the CAS what evidence it expects for the manual review.

Steps to write and evidence the policy

This sequence turns the CIS enterprise asset management policy template into an approved policy with a working asset register, a weekly unauthorized asset process and dated outputs that show the inventory was reviewed. Each step closes with a named output so the policy can be tested against the Safeguard 1.1 and 1.2 checks.

Confirm scope and asset classes
Meet the owner of each asset type in scope, including end-user devices (including mobile), network devices, IoT, servers, virtual and cloud assets, and devices that regularly connect without enterprise control. Agree which asset classes sit inside the policy boundary and who speaks for each. The output is a signed scope statement listing asset classes and their named owners. The step is done when every class that can store or process enterprise data has a named owner.
Agree inventory fields and register owner
Define the fields the register must hold for each asset: static network address where one exists, hardware address, machine name, asset owner, department and whether the asset is approved to connect to the network. Name one accountable owner for the register and a backup who can update it. Where mobile device management tools hold part of the data, record which system is the source for each field. The output is a field specification and a named register owner, approved by the owner of the policy.
Define the unauthorized asset process
Write the weekly handling process required by Safeguard 1.2. Set the trigger, such as a discovered asset with no approval record, and the person who receives the alert. List the actions the enterprise allows: removing the asset from the network, stopping remote connection, or quarantining it. Record who may choose between these actions and how each decision is logged. The output is a documented procedure with a weekly run schedule and a sample decision record that an assessor can read.
Set the review cadence
Set the inventory review frequency at no less than twice a year, as Safeguard 1.1 requires, and write it into the policy. Add a review trigger for significant changes such as a new site, cloud account or device class, and assign a reviewer for each review. The Assessment Specification treats an inventory last updated more than six months ago as a failure, so the cadence must be shorter than that window. The output is a review calendar with named reviewers and dates recorded in the policy.
Approve the policy at the right level
Route the draft through the people who own the risks: the CISO or security lead, IT operations, and the business owners of the asset classes in scope. Ask the approver to confirm that the policy matches the scope statement, field specification and weekly procedure. Record the approval with a version number and effective date. The output is an approved policy version and a change log showing who reviewed it. Confirm with your own governance rules which level of sign-off your organization requires.
Run one full inventory cycle
Run discovery across every in-scope asset class and reconcile the results against the register. Record each discovered asset that is missing from the register, each register entry that no longer appears on the network, and each asset that lacks an approval status. Work the weekly unauthorized asset process on the findings and log each action. The output is a dated inventory snapshot, a reconciliation report and the weekly decision records. Keep these outputs with their timestamps, because they are what an assessor will request.
Retain dated outputs as evidence
Store the approved policy, scope statement, field specification, review calendar, reconciliation reports and weekly decision records in a controlled location with retention rules that match your evidence needs. Check that each inventory update is traceable to a date and an owner. Ask an independent assessor to confirm which artifacts they expect to sample. DeployOpen can help prepare these records for a readiness review, but the organization owns the controls, and only an independent auditor or assessor issues any report or certificate.

What makes the inventory harder to keep current

The effort to keep a Safeguard 1.1 inventory accurate depends less on the size of the estate than on how many places assets appear, who has to confirm them, and whether any tooling already tracks them. Each card below names one driver, the control that keeps the record current, and what to check before you commit to a review cadence.

Locations and cloud accounts

Every site, data center, virtual network and cloud account is a separate source of assets that can drift out of the record. Safeguard 1.1 covers on-premises, virtual, remote and cloud assets alike, so a cloud account that nobody lists is a gap even when the on-premises inventory is tidy. Confirm which accounts and regions feed the inventory, who owns each one, and whether each source can be exported on the same schedule as the rest.

Remote and BYOD mobile devices

Phones and tablets are enterprise assets when they store or process enterprise data, and personal devices often connect without anyone recording them. CIS notes that mobile device management tools can help with mobile devices, which gives you a source that reports device identifiers without manual entry. Check whether personal devices enrolled for email or file access are inside the inventory scope, and how the policy separates them from managed devices.

IoT and unmanaged connected assets

Safeguard 1.1 explicitly includes assets that regularly connect to the network but are not enterprise controlled, such as contractor laptops, building controllers and sensors. These devices rarely appear in a directory or agent console, so they are usually found through network observation rather than self-reporting. Ask who is responsible for recording a device that arrives on a vendor's laptop or a facilities system, and how a device is marked as not enterprise controlled.

Owners who must confirm records

Each record needs an asset owner and a department, and those fields go stale when people change roles or leave. The more owners who must confirm their own assets, the more chances a review slips past the six-month limit that the assessment specification applies. Decide who sends confirmation requests, what happens when an owner does not reply, and how orphaned assets are reassigned before the review is due.

Existing asset management tooling

If an asset management or discovery tool already exists, the inventory is partly built, but its records may not match what the network actually shows. A tool that holds records without a discovery feed will only be as current as the people who update it. Confirm which system is the authoritative inventory, whether discovered assets are reconciled against it, and who can edit it.

How Snipe-IT can hold the inventory evidence

Snipe-IT is one self-hosted option for the register that Safeguard 1.1 asks for, and it is useful mainly as the system of record where each asset carries a unique asset tag, a serial number and a deployment status. Snipe-IT is licensed under AGPL-3.0-only, so the team should have its licence obligations reviewed before modifying the code. The practical value for an assessor is the consistency of the records: each asset has one identifier that can be traced from purchase through deployment to retirement. Before relying on any of this, confirm the exact fields, custom field options and export formats against the Snipe-IT documentation overview, because the register must also hold the network address, hardware address, machine name, owner, department and approval status that Safeguard 1.1 lists.

Check-out records are the part of Snipe-IT most relevant to the weekly handling of unauthorized assets under Safeguard 1.2. When an asset, licence or accessory is checked out, the record places it with a person, a location or another asset until it is checked back in, so the team can answer who or where an asset is without searching email or spreadsheets. Snipe-IT does not discover assets on its own. Network scans, endpoint management exports and cloud inventories still have to be matched against the register, and every discovered device with no matching record should be routed into the unauthorized-asset process. Ask the implementation team to document that matching step, its owner and how often it runs, because the assessment specification checks accuracy against discovered assets, not just the presence of a list.

Decide early whose records are authoritative for mobile and remote devices, since Safeguard 1.1 notes that mobile device management tools can help. Snipe-IT can record those devices, but the policy should state which system confirms that a device is still enrolled and which one is the register. Confirm with the platform team how check-out, check-in and status changes are logged, and whether those logs can be exported as dated evidence for a review in the assessment window. Whether any given capability fits the policy is a question for the written scope, tested against the documentation and a pilot register, not an assumption.

Who owns the policy, the inventory and the assessment

The organization owns the policy, the asset register and the outcome. Its leadership approves the enterprise asset management policy, names an owner for the inventory, and decides how often the inventory is reviewed. Safeguard 1.1 expects the inventory to be reviewed at least twice a year, and the assessment specification scores an inventory that has not been updated in more than six months as a failure, so the owner must keep it current between formal reviews. The same team runs the weekly process required by Safeguard 1.2 for unauthorized assets, which decides whether a device is removed from the network, blocked from remote connection or quarantined.

Policy approval: A named executive or governance body signs off the policy and its scope, including which asset types are in scope.
Register ownership: One accountable role maintains the inventory fields: network address if static, hardware address, machine name, asset owner, department and network approval status.
Weekly unauthorized asset handling: A staff member or team reviews newly seen devices each week and records the action taken.
Review cadence: Reviews are scheduled, minuted and kept as evidence.
Exceptions: Mobile, IoT and remote devices that are not enterprise controlled are recorded with their approval status.

Before engaging any partner, confirm internally who signs the policy and who answers for a missing device at a review meeting.

Questions teams ask about the Control 1 policy

Is the CIS enterprise asset management policy template free to use as is?

CIS publishes its policy templates for free, and the Controls themselves are free for any organization to use to improve its own cybersecurity. The licence, Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, does not allow derivative works, and commercial use requires CIS's prior approval. In practice, most organizations adopt the template with their own owner names, asset tools, review dates and approval records filled in, which is a use the licence permits. Confirm with CIS or your legal team before you publish a modified version commercially, distribute it to clients, or build a product on it. Check the CIS Controls FAQ for the current position.

Does the CIS policy template cover IG2 and IG3 Safeguards?

No. The CIS policy templates are written for IG1 Safeguards only, so they cover the essential cyber hygiene baseline and do not address IG2 or IG3 Safeguards. Control 1 has five Safeguards in total, with two applying from IG1, two added at IG2 and one added only at IG3. If your organization is in IG2 or IG3, treat the template as a starting point and extend it with the additional asset management requirements your implementation group adds, such as the Safeguards that address discovery and more detailed inventory practices. Confirm the exact Safeguards for your group against the CIS Controls v8.1 pages before you finalize the policy.

How often must the enterprise asset inventory be reviewed?

Safeguard 1.1 asks for the inventory to be reviewed at least twice a year, and the assessment specification checks that the inventory was last updated within six months. Your policy should state the review cadence, name the role that performs it, and record the date and outcome of each review. Frequent changes in your environment, such as cloud workloads that start and stop or a large mobile fleet, usually mean you should refresh the inventory more often than the minimum, because the six-month window is a ceiling rather than a target.

What happens if the asset inventory is more than six months old?

The CIS assessment specification scores Safeguard 1.1 as failing when no inventory is provided or when it was last updated more than six months ago. A stale inventory therefore fails the check even if the assets listed are correct. An assessor will also look at accuracy against discovered assets, completeness of the detailed records and the manual review of inventory procedures, so an old list usually scores poorly on those too. To avoid this, schedule reviews in your policy, assign an owner, and keep a dated change log so the assessor can see that updates happen between formal reviews.

Can we build this ourselves, or do we need outside help?

Most teams can adopt the template and build the inventory with their own staff, provided they have an accountable owner, access to device management and cloud consoles, and time to reconcile records. Outside help is usually useful when the inventory spans several clouds, data centers and mobile fleets, when records are split across tools, or when no one has time to run the discovery and reconciliation work. An implementation partner can prepare the tooling and evidence, but the organization must own the policy and its approval. Only an independent assessor or certification body issues any formal report or certificate, and DeployOpen does not issue audit reports, attestations or certifications.

What does the inventory work need from our team?

The work needs four things from your team: a named owner who approves the policy and receives review results, administrators who can export data from device management, cloud, network and identity systems, staff who can confirm which assets are approved to connect, and a process that routes unauthorized assets to someone who can act on them. The effort depends on how many asset sources you have and how much the records already agree. Before you start, ask for a written scope that lists the asset classes, sites and tools in play, so the work and its deliverables are agreed in writing ahead of time.

Where to read the CIS source text before you draft

Start with the authoritative text, not with a template. The CIS Controls Policy Templates page is the entry point: CIS built its enterprise asset management template to align with CIS Controls v8 and v8.1 and to cover only IG1 Safeguards, so the template is a starting draft for Control 1 and not a full statement of what Control 1 requires. Read the CIS Controls Policy Templates page first, then the CIS Control 1 page for the full wording of the five Safeguards, 1.1 to 1.5.

The assessment specification is the source your assessor will use. Compare your draft line by line against the Safeguard 1.1 section of the CIS Controls Assessment Specification for Controls v8.1 and the Safeguard 1.2 section for handling unauthorized assets. Confirm the six-month inventory age limit, the accuracy and completeness measures and the weekly unauthorized-asset process against the current version before you rely on them, because the specification sets the scoring rules your policy must support.

Do not copy the template into your policy. Each fact in the policy, such as review cadence, record fields and quarantine steps, has to match how your environment actually discovers, records and removes assets. Ask your asset owners which discovery sources you have, who approves a device for the network and which teams can act on an unauthorized asset within a week. Record any gap between the template and your practice as a decision for the policy owner to resolve, and keep the CIS text in your files so the wording can be traced to its source when the policy is reviewed.

How DeployOpen prepares the Control 1 inventory and evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, including the asset inventory tooling that supports Control 1. We prepare the inventory, the unauthorized asset process and the evidence an assessor will ask to see, while the organization keeps ownership of its controls and policy.

How we scope

Agree in writing which asset classes, networks, cloud accounts and sites the Control 1 inventory will cover.
Confirm which Safeguards from Control 1 are in scope at the client's Implementation Group.
Document the inventory fields the policy requires, such as owner, department and approved-to-connect status.

How we build

Deploy a self-hosted asset register inside the client's environment and load existing asset sources into it.
Configure asset tags, serial numbers, check-out status and ownership fields so each record can be reviewed.
Set up a documented weekly workflow for unauthorized assets, covering removal, remote blocking or quarantine.

How we hand over

Deliver the inventory configuration, data dictionary and review procedure as written documentation.
Provide evidence exports showing record currency, completeness and review dates for the client's own files.
Walk the client's owners through the process so they can run the inventory and produce evidence themselves.

How we support

Offer ongoing support and upgrades as a retainer after handover, if the client chooses.
Test the inventory and unauthorized asset workflow again when the environment changes significantly.
Confirm with the client's independent assessor which evidence format and review cadence they expect.

CIS enterprise asset management policy template (Control 1)