Asset inventory

An asset inventory is a reconciliation problem rather than a list-keeping problem. No single source sees everything, so mature programmes merge several: directory services (Active Directory, Entra ID), MDM/UEM and EDR agent consoles, DHCP and DNS logs, switch ARP and CAM tables, active network discovery scans, passive traffic analysis (the only safe method on many OT networks, where active probing can crash PLCs), cloud provider APIs, virtualisation managers and purchasing records. Each record is keyed on something stable - serial number, MAC address, cloud instance ID, agent ID - and the interesting output is the delta: devices seen on the network but not in the inventory are unmanaged or rogue, and inventory entries not seen for weeks are stale or lost. Tools that do this correlation are marketed as cyber asset attack surface management (CAASM).

CIS Controls v8 puts this first for a reason. Control 1 (enterprise assets) asks for a detailed inventory reviewed at least bi-annually (Safeguard 1.1) and a process to deal with unauthorised assets weekly (1.2); Control 2 does the same for software, including an allowlist-based approach at higher Implementation Groups. ISO/IEC 27002:2022 control 5.9 (inventory of information and other associated assets) additionally requires an identified owner for each asset, and NIS2 Art. 21(2)(i) lists asset management among the mandatory measures. The owner field matters more than it looks: without it, vulnerability findings, end-of-life decisions and risk acceptances have nobody to route to.

Software inventory has moved from "which applications are installed" towards component-level transparency. A software bill of materials (SBOM), in SPDX or CycloneDX format, lists the libraries inside a product, which is what lets an organisation answer "where do we run a vulnerable Log4j version?" in hours rather than weeks. The EU Cyber Resilience Act makes SBOMs a manufacturer obligation for products with digital elements, on a timeline that runs to the end of 2027.

Common failure modes: treating the CMDB (a configuration model built for IT service management, with relationships between configuration items) as a security inventory without checking its completeness; missing ephemeral cloud workloads and containers that live for minutes; ignoring SaaS subscriptions bought on credit cards (shadow IT); and forgetting non-traditional endpoints such as printers, IP cameras, building-management controllers and conference-room systems. The measure of quality is coverage - the share of observed devices that are known and owned - not the length of the list.