AM-01 Asset Inventory
Maintain inventory procedures that keep asset records complete, accurate, valid and consistent throughout the asset lifecycle, whether populated automatically or by the responsible owners, hold the attributes the risk pr
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Discovery tooling configuration and its reconciliation report against the recorded register · Cloud console / configuration management
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Inventory extract showing owner, location, lifecycle state and the risk relevant attributes per asset · Policy repository / GRC workspace
- Field level change history identifying who altered an inventory record and when · Policy repository / GRC workspace
- Procedure defining the triggers that force an inventory update at acquisition, transfer and retirement · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Register rebuilt by hand in a spreadsheet and already out of date at the time of audit
- Instances created by automation or autoscaling never reach the register
- Entries carry hostnames only, without the ownership and protection attributes the risk procedure consumes
- Retired items still show as active because no retirement update is ever recorded
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet