ID.IM-P1: Systems/products/services that process data are inventoried
Description
[csf.tools Note: Subcategories do not have detailed descriptions.]
Related Controls
NIST Special Publication 800-53 Revision 5.2.0
CM-8: System Component Inventory
Develop and document an inventory of system components that: Accurately reflects the system; Includes all components within the system; Does not include duplicate accounting of components or components assigned to any other system; Is at the level of granularity deemed necessary for tracking and reporting; and Includes the following information to achieve system component accountability:…
CM-12: Information Location
Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored; Identify and document the users who have access to the system and system components where the information is processed and stored; and Document changes to the location (i.e., system or system components) where…
CM-13: Data Action Mapping
Develop and document a map of system data actions.
PM-5: System Inventory
Develop and update [Assignment: organization-defined frequency] an inventory of organizational systems.
Cloud Controls Matrix v4.0
CCC-04: Unauthorized Change Protection
Restrict the unauthorized addition, removal, update, and management of organization assets.
DCS-05: Assets Classification
Classify and document the physical, and logical assets (e.g., applications) based on the organizational business risk.
DCS-06: Assets Cataloguing and Tracking
Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.
DSP-03: Data Inventory
Create and maintain a data inventory, at least for any sensitive data and personal data.
DSP-05: Data Flow Documentation
Create data flow documentation to identify what data is processed, stored or transmitted where. Review data flow documentation at defined intervals, at least annually, and after any change.
DSP-13: Personal Data Sub-processing
Define, implement and evaluate processes, procedures and technical measures for the transfer and sub-processing of personal data within the service supply chain, according to any applicable laws and regulations.
DSP-19: Data Location
Define and implement, processes, procedures and technical measures to specify and document the physical locations of data, including any locations in which data is processed or backed up.
IVS-08: Network Architecture Documentation
Identify and document high-risk environments.
STA-07: Supply Chain Inventory
Develop and maintain an inventory of all supply chain relationships.
UEM-04: Endpoint Inventory
Maintain an inventory of all endpoints used to store and access company data.
NIST Special Publication 800-53 Revision 4
CM-8: Information System Component Inventory
The organization: Develops and documents an inventory of information system components that: Accurately reflects the current information system; Includes all components within the authorization boundary of the information system; Is at the level of granularity deemed necessary for tracking and reporting; and Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability];…
PM-5: Information System Inventory
The organization develops and maintains an inventory of its information systems.