Open source ITSM for CIS Controls 1 and 2: what the inventory must prove
When an assessor or board asks for proof of your asset and software inventory, the answer is a set of records that show the inventory runs, not a diagram of a tool. GLPI, with its agents and network discovery, can produce the records behind CIS Safeguards 1.1, 1.2 and 2.1: the enterprise asset inventory, the weekly handling of unauthorized assets and the software inventory. The tool does not make the program run, though. Someone must own the review cadence, define what counts as an authorized asset, and act on what discovery finds. The evidence of operation is what the reader should be asking for, and it is the part that most often falls short.
CIS Controls are free for any organization to use to improve its own cybersecurity, and CIS states that they do not replace any regulatory, compliance or authorization scheme. That distinction matters in the room. A CIS-aligned inventory can support a regulator's or auditor's request, but it does not satisfy one by itself, and the mappings CIS publishes to other frameworks are the place to check which obligations your inventory feeds. The Controls Navigator for v8.1 lists mappings to 30 frameworks and versions as of October 2026, so confirm the exact versions your auditor uses before you map anything.
Start by agreeing with the assessor which records count as evidence for Safeguard 1.1, which for 1.2 and which for 2.1, and how often each must be reviewed. Safeguard 1.1 is reviewed at least twice a year, Safeguard 2.1 likewise, and Safeguard 1.2 runs at least weekly. Then confirm that GLPI Agent and discovery actually write the fields the Safeguards expect, such as owner, department and approval status, and that the weekly unauthorized-asset process leaves a dated trail. Ask your implementation partner to show those records from a live instance before go-live, not a demo database.
How each CIS Safeguard maps to GLPI configuration
This table sets each in-scope Safeguard against the GLPI configuration that supports it, so you can see which fields, agents and workflows produce the evidence an assessor will ask for. The CIS Assessment Specification defines what to measure, not how, so the configuration column describes one reasonable approach to confirm with your own team. Read each row as a checklist for the data you need before go-live.
| Requirement | What the function must do | How to configure GLPI |
|---|---|---|
| Safeguard 1.1: Enterprise asset inventory (Devices, Identify, IG1) | Keep an accurate, current record of every enterprise asset that can store or process data, including mobile, network, IoT, server, virtual, remote and cloud assets, and review it at least twice a year. | Deploy GLPI Agent for network discovery and inventory on Windows, macOS and Linux. Record owner, department, machine name, MAC address, static IP where used, and an approved-to-connect status on each asset. Use MDM data for mobile devices and schedule a twice-yearly review task. |
| Safeguard 1.1: Non-enterprise assets that connect | Identify assets that regularly connect but are not enterprise controlled, such as contractor or personal devices. | Create a distinct asset status or type for non-managed devices. Use network discovery results to flag unknown MAC addresses and assign an owner or a removal ticket. |
| Safeguard 1.2: Unauthorized asset handling (Devices, Respond, IG1) | Run a process at least weekly to find unauthorized assets and remove, block or quarantine them. | Compare discovery results with the approved-to-connect field each week. Open an incident or change ticket for each unapproved asset, and record the action taken (removal, remote block or quarantine) on the asset record. |
| Safeguard 1.2: Weekly run evidence | Show that the weekly check ran, what it found and how each finding was closed. | Keep discovery run history and the linked tickets together. Use a recurring reminder or scheduled report so the weekly cycle leaves a dated trail. Confirm retention with your auditor. |
| Safeguard 2.1: Software inventory (Software, IG1) | Keep a detailed record of licensed software installed across assets, reviewed at least twice a year. | Use GLPI Agent software inventory on each managed asset. Maintain a software catalog with title, publisher, business purpose and date of first installation or use. Add license count, version, deployment method and decommission date where relevant. |
| Safeguard 2.1: Software entry completeness | Give each entry the attributes CIS describes, where relevant to the enterprise. | Make publisher and business purpose required fields in the software catalog. Link each installed item to a license record. Confirm which optional attributes (app store, URL) your environment needs. |
| Safeguard 2.1: Twice-yearly review | Review and update the software inventory at least twice a year. | Schedule a recurring review task tied to the software catalog. Keep the review output as a dated record with the approver's name and any changes made. |
How GLPI agents and network discovery find assets nobody registered
Registration alone will never produce an accurate inventory, because the assets that create the most risk are the ones nobody entered. The GLPI Agent closes part of that gap by collecting hardware and software inventory on Windows, macOS and Linux and sending it to GLPI. The same agent family also performs network discovery and inventory, which is how devices with no installed agent can surface as records. Per the GLPI Agent documentation, the agent is the successor of FusionInventory Agent. Before rollout, confirm which discovery methods your agent version supports, which subnets and ranges the discovery task may scan, and who approves scan scope on segments that carry operational or regulated traffic.
Some assets will never run a GLPI Agent: personal or contractor devices that regularly reach the network, mobile devices, virtual machines that appear and disappear, and cloud workloads created outside the service desk. CIS Safeguard 1.1 expects the inventory to cover these, including assets that connect but are not enterprise controlled. For mobile devices, CIS notes that mobile device management tools can help, so decide whether your MDM platform feeds GLPI or whether mobile records are maintained separately. For cloud and virtual assets, confirm which hypervisor, cloud account or tagging sources can be read and how often. None of these sources is assumed here; each must be confirmed in the client environment before it is treated as authoritative.
Discovery output is a set of candidates, not a finished inventory. Reconcile discovered records against identity data, DHCP leases or network address records, and the CMDB, so each record can be matched to an owner, a department and an approval status. Records that match nothing are the unauthorized candidates that Safeguard 1.2 requires you to handle on a weekly cycle. Ask your implementation partner to document the matching keys (for example hardware address, machine name or address) and the rules for conflicts, because a poor key choice creates duplicates that look like new assets and hide real ones.
Which open-source platforms fit CIS Controls 1 and 2
Controls 1 and 2 need an inventory that is accurate, current and tied to who owns each asset and each license. The options below separate the ITSM platform, the CMDB model, the collection agent and the hosting model, because each choice changes what evidence you can produce and who maintains it.
GLPI as the inventory system of record
GLPI is GPL-3.0 IT asset management and ITIL service desk software, with assets, software, contracts and tickets in one database. Current release 12.0.0 was published October 7, 2026. It fits teams that want asset records, software entries and incident or change tickets to share one data model. Verify the runtime before committing: the GLPI README lists PHP 8.3 or later and MariaDB 10.11 or later or MySQL 8.0 or later, while the installation docs for GLPI 11.0 list PHP 8.2 or later with MySQL 8.0 or MariaDB 10.6. Only MySQL and MariaDB are supported, so PostgreSQL shops should plan for that gap.
iTop for a customizable CMDB
iTop is AGPL-3.0 and built around a data model you can extend. Version 3.3.0 was published September 15, 2026. It suits organizations whose Control 1 record needs custom classes, such as OT assets, clinical devices or cloud resources with owners and approval status that do not map cleanly to default asset types. The trade-off is design effort: someone must own the data model, relations and lifecycle states. Confirm the supported database and PHP versions for the release you pick, and confirm which agents or connectors exist for your device mix, since iTop does not bring a discovery agent of its own.
GLPI Agent as the collection layer
GLPI Agent gathers hardware and software inventory and sends it to GLPI. It also runs network discovery and inventory, and it runs on Windows, macOS and Linux. It is the successor of FusionInventory Agent. For Safeguard 1.1 it can produce the machine name, network data and installed software that feed the record, while mobile devices and non-enterprise devices usually need a separate source such as mobile device management or network scanning. Test how the agent reports on laptops that are often offline, and decide how stale records are flagged so that Safeguard 1.2 reviews start from reliable data.
Self-hosted GLPI versus GLPI Network
Self-hosting keeps inventory data inside your own environment, and GLPI Network moves operations to Teclib'. Self-hosted subscriptions are priced by tier, and GLPI Network public and private cloud are priced per user per month, with private cloud requiring a 25-user minimum. Ask which party patches PHP and the database, who restores backups, and where the inventory database resides. Regulated organizations often need the data location written into the contract. Request a written scope that shows support level, plugin coverage and update responsibilities before comparing totals.
Authentication and update controls
GLPI tries authentication sources in order: the internal database, LDAP, IMAP and external methods. Connect LDAP or SSO early so administrator accounts are tied to your directory and removed on departure. Plugins are suspended after a new version is detected and must be reactivated after major updates, so inventory connectors can stop collecting until someone re-enables them. Before each update, back up the database, files and the config directory including glpi.key and glpicrypt.key, following the update procedure in the installation docs.
What assessors ask to see for CIS Controls 1 and 2
What does an assessor expect in an enterprise asset inventory export?
The assessor expects a current export that lists every enterprise asset able to store or process data, including end-user, mobile, network, IoT and server devices, whether on premises, virtual, remote or in the cloud. For each asset, the export should show the network address if static, the hardware address, machine name, asset owner, department and whether the asset is approved to connect to the network. In GLPI, the Assets module (computers, network equipment, peripherals, and similar item types) holds these records, and GLPI Agent populates hardware and network data automatically. Assets that regularly connect but are not enterprise controlled should appear too, so confirm with your assessor how they want those flagged. Mobile devices usually need a mobile device management tool as a source, since GLPI Agent does not cover them in the same way.
How often do assessors expect the asset inventory to be reviewed?
Safeguard 1.1 expects the inventory to be reviewed at least twice a year, and the review itself should leave a record. Keep dated review records showing who checked the export, what changed, and which discrepancies were resolved. In GLPI, you can capture this with saved searches or reports on the Assets module, combined with a recurring task or ticket in the Assistance module that is closed with the review results attached. Confirm the review cadence and evidence format with your assessor before go-live, because the review record is what most often gets missed.
What proves unauthorized assets are handled every week?
Safeguard 1.2 requires a process, run at least weekly, for handling assets that are not authorized. The enterprise may remove such an asset from the network, stop it from connecting remotely, or quarantine it. The evidence is a weekly log that shows each unauthorized asset found, the date it was detected, the action taken, and the closure date. In GLPI, unauthorized devices can be surfaced through discovery and inventory results compared against approved records, and each finding can be tracked as a ticket in the Assistance module so the action and outcome are timestamped. The exact removal or quarantine step depends on your network controls, which GLPI records but does not enforce on its own.
What fields must a software inventory entry contain?
Safeguard 2.1 asks for a detailed record of every licensed software title installed across assets, reviewed at least twice a year. For each entry, the inventory should give the title, publisher, business purpose, and date of first installation or use. Where relevant, it should also record the number of licenses, decommission date, deployment method, versions, app stores and URL. In GLPI, software titles and versions are collected by GLPI Agent during inventory and stored in the Software items of each asset, while the business purpose and owner can be added as custom fields or linked to the relevant asset and department. Check that your agent collects installation dates where your assessor expects them, since not every field is populated by default.
Which GLPI records show software license entitlements and compliance?
Assessors usually want to see that installed software is matched against what the organization is entitled to run. In GLPI, the Management module holds licenses, linked to software titles, with fields for number of seats, expiration and the assets or users they are assigned to. Comparing license counts with installed counts from inventory gives the reconciliation view. Keep purchase and renewal evidence attached to the license record or linked contract, and make sure the reconciliation is reviewed on the same twice-yearly cycle as the software inventory. Confirm the exact license reports your team needs with the vendor documentation for your GLPI version, because report availability can differ between releases.
What change and decommission history should the inventory show?
A reliable inventory is only credible if assessors can see how assets and software entries changed over time. They typically ask for the date an asset joined the inventory, its ownership changes, software installs and removals, and the decommission date with the disposal method. In GLPI, the history tab on each asset and software item records field-level changes with timestamps and the user who made them, and ticket records in the Assistance module capture the approval and work behind larger changes. Decommissioned items should be set to a retired status rather than deleted, so the record remains available for the review period your assessor expects.
Can our own team produce this evidence, or do we need a partner?
Your team can produce most of this evidence with GLPI alone, provided the platform is configured and the data sources are in place. The main effort lies in agent rollout across all asset classes, defining what counts as an approved asset, setting up the weekly unauthorized asset process, and agreeing on the review format with your assessor. A partner typically takes that scope under a written, fixed-scope agreement, covering deployment, configuration, integrations with mobile device management or procurement data, and documented procedures. DeployOpen implements, configures and documents self-hosted GLPI inside your own infrastructure and prepares the evidence and controls for your assessment. DeployOpen does not issue audit reports or certifications; independent auditors and certification bodies do that work.
What GLPI tooling alone does not satisfy
GLPI can collect and store inventory data, but CIS Controls 1 and 2 also depend on policy, approval rules, coverage limits, license evidence and a review cycle that a tool cannot supply on its own. The cards below set out each gap and the remedy to put in place alongside the platform.
Written asset policy and owner
GLPI can record an owner field on every asset, but it cannot decide who is accountable for an asset class or what counts as an enterprise asset. Without a written policy naming a single accountable owner per asset class, owner fields drift and become stale. Check that the policy defines the asset scope, names the owner role for each class, and states who approves changes to the inventory rules.
Approval standard for connecting assets
Safeguard 1.1 expects the inventory to record whether each asset is approved to connect to the network, but discovery only reports what it sees. A defined approval standard sets the criteria, such as hardware baseline, ownership and configuration checks, that must be met before an asset is marked approved. Confirm that the standard is written, that GLPI's approval status is set only through that standard, and that exceptions are recorded with an owner and an expiry.
Agent coverage gaps on unmanaged devices
Inventory agents report from devices where they can be installed, so printers, IoT sensors, appliances and many OT controllers may never appear. Network discovery and manual records can fill part of the gap, but each method has its own blind spots. Map which device classes your agents cannot reach, assign a documented method for each, and confirm with plant or facilities owners where segmented networks limit scanning.
License entitlement that discovery cannot prove
Software discovery shows what is installed, not what the organization is entitled to run. Safeguard 2.1 asks for licensed software records that include the number of licenses, deployment method and decommission date, and those values come from contracts, purchase records and vendor portals. Reconcile installed counts against entitlements at each review, and record where each license proof is held so an auditor can trace it.
Review cadence and sign-off
Safeguard 1.1 and Safeguard 2.1 both call for reviews at least twice a year, and Safeguard 1.2 calls for a weekly process for unauthorized assets. Those are minimum frequencies, and a tool cannot show that a person reviewed the data and accepted it. Set a dated review calendar, name the signatory for each review, and keep the signed output with the GLPI export it covers.
CIS mappings do not replace regulatory schemes
CIS states that the Controls do not replace regulatory, compliance or authorization schemes, even though it maps them to frameworks such as NIST CSF 2.0 and ISO/IEC 27001:2022. A GLPI inventory that satisfies a CIS Safeguard may still be missing evidence a specific regulator or assessor expects. Ask your compliance lead which regulation or framework applies, then confirm the evidence format and retention period with the assessor before the inventory is used as proof.
Where CIS Controls v8.1 sits next to other frameworks
Safeguards 1.1, 1.2 and 2.1 all belong to Implementation Group 1, the essential cyber hygiene baseline that CIS describes as a minimum standard for every enterprise. Version 8.1 contains 153 Safeguards in 18 Controls, and IG1 accounts for 56 of them. That placement matters for scoping: an organization that is not yet at IG2 or IG3 still needs an accurate asset inventory, a weekly unauthorized-asset process and a software inventory reviewed twice a year. Confirm with your security lead which IG your enterprise has adopted, because that choice determines which Safeguards your evidence must cover and which ones are beyond the current scope.
The CIS Controls Navigator maps v8.1 to other frameworks, including NIST CSF 2.0, ISO/IEC 27001:2022, PCI DSS v4.0 and NIS2. The practical benefit is that one GLPI inventory, with its discovery history and software records, can supply evidence to several assessments at once. The limit is that a mapping is a starting point, not a compliance determination. Before you cite a mapping in front of an assessor, confirm the exact control identifiers and their wording with the framework owner or your assessor, and check the Navigator version against the framework version your auditor uses.
Use the mapping work to decide which evidence to build once. Record the inventory fields, review dates and quarantine decisions in GLPI so that a single export can be tagged against each framework's controls. Keep the CIS mapping separate from any statement of conformity: CIS states that the Controls do not replace regulatory, compliance or authorization schemes, so your sector regulator or assessor still decides what counts as sufficient. Where a framework asks for something CIS does not cover, such as formal risk acceptance or records retention periods, plan a separate artifact rather than stretching the inventory to fit.
How much effort does a CIS Controls 1 and 2 inventory take with GLPI?
What drives the effort of a GLPI-based CIS Controls 1 and 2 inventory?
The effort scales with how many assets you have, how many network segments they sit on, and how much existing data needs cleaning before it is trustworthy. The main drivers are the number of endpoints (end-user, server, network, IoT, mobile and cloud), the number of segments where discovery must run, the number of systems that must feed the CMDB, the state of existing spreadsheets and procurement records, the rollout method for agents, and how approvals for unauthorized assets are designed. Each driver adds work in a different phase, so ask a partner to break the quote down by phase rather than by a single total.
Can our own IT team build a CIS Controls 1 and 2 inventory in GLPI?
Yes, many teams can, provided someone owns the GLPI installation, the discovery configuration and the inventory rules. GLPI is GPL-3.0 software, so the licence cost is zero, but the work of installing it, configuring discovery, deploying the GLPI Agent, normalizing data and writing review procedures still has to be staffed. In-house teams usually struggle with three things: getting agent coverage to the full estate, reconciling records from several sources, and running the weekly unauthorized-asset process reliably. A partner can take on any subset of that work under a written scope.
How long does it take to reach a first reliable inventory with GLPI?
The honest answer depends on your estate, and no duration is fixed by the supplied facts. The first reliable inventory usually arrives after three steps are complete: GLPI is installed and hardened, discovery and agents report from every segment you care about, and someone has reviewed the results against known sources such as directories and procurement records. Ask any partner to give a duration tied to a named list of segments, asset classes and integrations, and to say which steps depend on your change windows and access approvals.
What do our IT and security teams need to provide for the inventory work?
Plan for named owners in four areas: IT operations for network access, directories and agent deployment; security for approval rules, quarantine decisions and review of the weekly unauthorized-asset process; procurement or finance for purchase and license records; and an application owner for each system that will feed or consume the inventory. Each owner should confirm access to the relevant network ranges, service accounts and sources before work starts. Missing owners are the most common reason inventories stall after the technical build is finished.
Do we need a paid GLPI support or subscription to run a CIS Controls inventory?
No. GLPI is licensed under GPL-3.0 and can be self-hosted without a subscription. Paid options exist for teams that want vendor-backed support or managed hosting. According to the GLPI Network subscriptions page, GLPI Network public cloud costs 19 euros per user per month and private cloud 21 euros per user per month with a 25-user minimum, while self-hosted subscriptions range from 100 euros per month (Basic, up to 10 agents and 500 assets) to 4,500 euros per month (Enterprise), which includes level 3 support and marketplace plugins. Confirm current pricing directly with the vendor, because those figures may change.
Does CIS Controls accreditation or certification apply to our inventory?
No certification applies to the Controls themselves. CIS Controls are free for any organization to use to improve its own cybersecurity, and CIS states they do not replace regulatory, compliance or authorization schemes. CIS Controls Accreditation, run with CREST, applies to CIS SecureSuite member organizations that provide CIS Controls implementation, auditing or assessment services, and the CIS page lists application fees of $1,500 for CREST members and $2,500 for non-members. DeployOpen prepares systems and evidence for assessments but does not issue audit reports, attestations or certifications. Ask any party you hire whether it holds accreditation, and what it can and cannot attest to.
What DeployOpen delivers for the inventory program
DeployOpen can plan the inventory program in writing before any work starts. The scope typically covers a GLPI deployment inside your own infrastructure, including the web server document root, the database, and the backup of glpi.key and glpicrypt.key from day one. On top of that platform, the work includes packaging GLPI Agent for Windows, macOS and Linux, rolling it out in waves, and configuring network discovery so that assets which never run an agent still appear in the record. Each of these items is named in the statement of work, with owners and acceptance checks agreed up front.
The data model is where most of the inventory's value is decided, so DeployOpen scopes it explicitly. That includes the fields needed for Safeguard 1.1 (network address where static, hardware address, machine name, asset owner, department and whether the asset is approved to connect), the software entries needed for Safeguard 2.1, and the status values and approval workflow that feed the unauthorized asset process under Safeguard 1.2. The weekly handling process is built as a ticket workflow in GLPI, with a defined owner, escalation path and the containment options your policy allows: removal from the network, blocking remote connection, or quarantine. DeployOpen can then run a test cycle of that weekly process with your team and record the results.
DeployOpen also prepares the evidence and documentation that an assessor will ask for: exports of the asset and software inventories, review records for the twice-yearly reviews, weekly process logs, and written procedures. DeployOpen prepares these controls and evidence for assessment, but it does not issue audit reports, attestations or certifications, and it is not a CIS Controls accredited provider. Before signing, confirm with your assessor which evidence format they accept, and ask the implementation partner to show how each export maps to the specific Safeguard it supports.
How DeployOpen works on this
DeployOpen plans, implements, customizes, integrates, documents and supports self-hosted open-source platforms inside your own infrastructure. For a GLPI-based inventory mapped to CIS Controls 1 and 2, the work starts with a written scope that defines which asset classes, networks and software sources are covered before any agent is deployed.
How we scope
- Agree in writing which device classes, networks and cloud accounts the GLPI inventory must cover for Safeguard 1.1.
- Define the approved-to-connect rule and the owner of each unauthorized-asset response for Safeguard 1.2.
- Confirm the software inventory fields for Safeguard 2.1, such as publisher, business purpose and first install date.
How we build
- Deploy and configure GLPI and its inventory agents against the agreed scope, following your change process.
- Map discovery sources, such as agents, network scans and MDM exports, into one asset record per device.
- Test the inventory against a sample of known assets and document the gaps that remain before go-live.
How we hand over
- Deliver configuration records, runbooks and a written mapping of each inventory field to the CIS Safeguard it supports.
- Document the twice-yearly review and the weekly unauthorized-asset process so your team can run them without us.
- Provide training for administrators on agent updates, database backups and the GLPI update procedure.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the build.
- Retainers can cover GLPI version upgrades, plugin revalidation after major releases and agent maintenance.
- Confirm with us which GLPI subscription tier, if any, your support model requires before you sign the scope.
