2.1: Establish and Maintain a Software Inventory
CSF v1.1 References:
Incorporates the following controls from the previous version: 2.1: Maintain Inventory of Authorized Software, 2.4: Track Software Inventory Information.
Control Statement
Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The software inventory must document the title, publisher, initial install/use date, and business purpose for each entry; where appropriate, include the Uniform Resource Locator (URL), app store(s), version(s), deployment mechanism, and decommission date. Review and update the software inventory bi-annually, or more frequently.
[csf.tools Note: For more information on the Critical Security Controls, visit the Center for Internet Security.]