1.1 Establish and Maintain Detailed Enterprise Asset Inventory

Keep a complete, accurate and current register of every enterprise asset able to hold or process data: end-user devices (portable and mobile included), network gear, IoT and other non-computing devices, and servers, whether attached on premises, virtually, remotely or in the cloud, and including devices that regularly join the network though the enterprise does not control them. Each record carries the static network address where one exists, the hardware (MAC) address, the machine name, the data asset owner, the department and whether the device is approved to connect. Mobile device management tooling may feed the register for phones and tablets. Review and refresh it at least twice a year. Implementation Groups: IG1, IG2 and IG3 (part of the IG1 essential cyber hygiene baseline, so every enterprise applies it). Asset type: Devices. Security function: Identify.

Source: CIS Controls v8.1, 1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CIS Controls v8.1 in the compliance library.

Each safeguard shows its Implementation Groups. IG1 is the essential baseline for every enterprise, IG2 adds to it, IG3 is all 153. Version 8.1 adds the Govern security function and asks for more processes to be documented; numbering is unchanged from v8.