ID.AM-01 Hardware inventory
Keeping inventories of all hardware the organization manages, including IT, IoT, OT and mobile devices, and detecting new devices on the network to keep them current.
ID.AM Asset management
Asset Management: inventories of hardware, software, services, supplier services and data, network and data flow maps, prioritization and life cycle management; seven Subcategories.
ID.AM-02 Software, services and systems inventory
Inventories of software, services and systems the organization manages, from commercial and open-source software to custom applications, APIs, cloud services, containers and virtual machines.
ID.AM-03 Network and data flow maps
Documenting authorized network communication and internal and external data flows, including flows with third parties and in IaaS, and the expected ports, protocols and services.
ID.AM-04 Supplier services inventory
An inventory of the external services the organization uses, such as IaaS, PaaS, SaaS and APIs, updated whenever a new external service is adopted.
ID.AM-05 Asset prioritization
Prioritizing assets by classification, criticality, resources and mission impact, with defined criteria for each asset class and updates when the organization changes.
ID.AM-07 Data inventory and metadata
Inventories of designated data types such as PII, PHI, financial account numbers and intellectual property, with classification labels, owners, provenance and location.
ID.AM-08 Asset life cycle management
Managing systems, hardware, software, services and data from acquisition to disposal, including shadow IT discovery, secure configuration before deployment, data destruction records and media sanitization.
