What it means
A useful inventory identifies each asset, its owner, purpose, location, lifecycle state, dependencies, sensitivity, and management source. It is maintained through discovery and operational processes rather than as a one-time spreadsheet.
Why it matters
Security teams cannot assess exposure, prioritize vulnerabilities, investigate incidents, or plan recovery when important assets and dependencies are unknown.
Practical focus
- Define which asset classes and attributes are required
- Combine authoritative records with automated discovery
- Assign ownership and lifecycle status
- Reconcile duplicates, unknown assets, and stale records
Common mistakes
- Counting only employee computers
- Treating discovery output as automatically authoritative
- Ignoring cloud, SaaS, identities, data, and operational technology
- Keeping retired assets in active inventories without status
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: