AST-04.3: Compliance-Specific Asset Identification
Mechanisms exist to create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
Control Question: Does the organization create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization?
General (8)
| Framework | Mapping Values |
|---|---|
| NIST 800-171 R3 (source) | 03.01.03 |
| PCI DSS 4.0.1 (source) | 6.3.2 12.5.1 12.5.2.1 A3.2.5 |
| PCI DSS 4.0.1 SAQ A-EP (source) | 6.3.2 |
| PCI DSS 4.0.1 SAQ D Merchant (source) | 6.3.2 12.5.1 |
| PCI DSS 4.0.1 SAQ D Service Provider (source) | 6.3.2 12.5.1 12.5.2.1 |
| SCF CORE Mergers, Acquisitions & Divestitures (MA&D) | AST-04.3 |
| SCF CORE ESP Level 2 Critical Infrastructure | AST-04.3 |
| SCF CORE ESP Level 3 Advanced Threats | AST-04.3 |
US (1)
| Framework | Mapping Values |
|---|---|
| US DHS ZTCF | BAS-03 |
EMEA (1)
| Framework | Mapping Values |
|---|---|
| EMEA EU NIS2 Annex | 12.4.2(a) 12.4.2(b) |
Americas (1)
| Framework | Mapping Values |
|---|---|
| Americas Canada ITSP-10-171 | 03.01.03 |
Capability Maturity Model
Level 0 — Not Performed
There is no evidence of a capability to create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/ or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
Level 1 — Performed Informally
C|P-CMM1 is N/A, since a structured process is required to create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/ or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
Level 2 — Planned & Tracked
C|P-CMM2 is N/A, since a well-defined process is required to create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/ or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
Level 3 — Well Defined
Asset Management (AST) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- An IT Asset Management (ITAM) function, or similar function, governs asset management to help ensure compliance with requirements for asset management.
- An ITAM function, or similar function, maintains an inventory of IT assets, covering both physical and virtual assets, as well as centrally managed asset ownership assignments.
- Technology assets and data are categorized according to data classification and business criticality criteria.
- A Cybersecurity Supply Chain Risk Management (C-SCRM) function oversees supply chain risks including the removal and prevention of certain technology services and/ or equipment designated as supply chain threats by a statutory or regulatory body.
- Data/process owners document where sensitive/regulated data is stored, transmitted and processed, generating Data Flow Diagrams (DFDs) and network diagrams to document the flow of data.
- Stakeholders create network diagrams that graphically represent compliance boundaries (e.g., in-scope vs out-of-scope).
Level 4 — Quantitatively Controlled
See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/ or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
Level 5 — Continuously Improving
See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to create and maintain a current inventory of Technology Assets, Applications, Services and/or Data (TAASD) that are in scope for statutory, regulatory and/ or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
Assessment Objectives
- AST-04.3_A01 an inventory of systems, applications and services exists for each specific statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
- AST-04.3_A02 inventories of systems, applications and services are kept current for each specific statutory, regulatory and/or contractual compliance obligations that provides sufficient detail to determine control applicability, based on asset scope categorization.
Evidence Requirements
- E-AST-02 Asset Scoping Guidance
-
Documented evidence of an asset scoping guidance. This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on defining in-scope systems, applications, services, processes and third-parties.
Asset Management - E-CPL-02 Defined Compliance Scope (DCS)
-
Documented evidence of a formal scoping document that identifies applicable statutory, regulatory and/or contractual obligations for the organization. Defines the affected Lines of Business (LOB), internal / external stakeholders and facilities for the specific scope of compliance obligations.
Compliance
Technology Recommendations
Micro/Small
- Unified Scoping Guide (https://unified-scoping-guide.com)
Small
- Unified Scoping Guide (https://unified-scoping-guide.com)
Medium
- Unified Scoping Guide (https://unified-scoping-guide.com)
Large
- Unified Scoping Guide (https://unified-scoping-guide.com)
Enterprise
- Unified Scoping Guide (https://unified-scoping-guide.com)