ID.AM: Asset Management
Next Version:
- NIST Cybersecurity Framework v2.0:
- ID.AM: Asset Management
Description
The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy.
Framework Subcategories
ID.AM-1: Physical devices and systems within the organization are inventoried
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.AM-2: Software platforms and applications within the organization are inventoried
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.AM-3: Organizational communication and data flows are mapped
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.AM-4: External information systems are catalogued
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.AM-5: Resources (e.g., hardware, devices, data, time, personnel, and software) are prioritized based on their classification, criticality, and business value
[csf.tools Note: Subcategories do not have detailed descriptions.]
ID.AM-6: Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established
[csf.tools Note: Subcategories do not have detailed descriptions.]