Asset Management (ID.AM) — NIST CSF 2.0 Category

CategoryID.AM — Asset Management

FunctionID — Identify CategoryID.AM — Asset Management

Official CSF Core outcome
Assets — data, hardware, software, systems, facilities, services, and people — that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy.

Category outcome

NIST CSF 2.0 places Asset Management (ID.AM) within the Identify Function. The official Category outcome is: “Assets — data, hardware, software, systems, facilities, services, and people — that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization’s risk strategy.”

This Category provides a structured way to address inventory, ownership, dependency, prioritization, data awareness, and life-cycle management. It groups related Subcategory outcomes without prescribing a specific technology, organizational model, or implementation sequence.

What this means in practice

A credible Asset Management capability connects policy and risk decisions to repeatable operating practices. The organization should define scope, ownership, expected outcomes, evidence, exceptions, and reassessment triggers.

Implementation should be proportionate to mission needs, legal and contractual obligations, threat exposure, business impact, and the organization’s risk appetite. The same Category may be implemented differently across systems and business contexts.

Implementation priorities

The following priorities translate the Category into an operating capability. They are starting points for design and governance, not a replacement for architecture, procedures, or risk analysis.

Discover and reconcile hardware, software, services, systems, data, and supplier-provided assets.
Assign owners and identify business purpose, location, dependencies, and criticality.
Represent authorized network communications and data flows.
Prioritize assets based on mission impact, sensitivity, exposure, and recoverability.
Manage assets from acquisition through change, transfer, and disposal.

Evidence and measurement

Evidence should show that the Category’s outcomes are achieved in the intended scope, remain effective, and are reviewed when conditions change. A policy, tool purchase, or completed checklist is not sufficient by itself.

Authoritative asset, software, service, and data inventories
Ownership, criticality, and dependency records
Network and data-flow diagrams
Discovery-to-inventory reconciliation results
Acquisition, change, transfer, and disposal records

Subcategories within ID.AM

This Category contains 7 CSF 2.0 Subcategory outcomes. Each outcome has a dedicated Bare Metal Cyber profile with the official NIST statement and original implementation guidance.

ID.AM-01 — Hardware Inventories: Inventories of hardware managed by the organization are maintained
ID.AM-02 — Software, Service, and System Inventories: Inventories of software, services, and systems managed by the organization are maintained
ID.AM-03 — Network Communication and Data Flow Representations: Representations of the organization’s authorized network communication and internal and external network data flows are maintained
ID.AM-04 — Supplier-Provided Service Inventories: Inventories of services provided by suppliers are maintained
ID.AM-05 — Asset Prioritization: Assets are prioritized based on classification, criticality, resources, and impact on the mission
ID.AM-07 — Data and Metadata Inventories: Inventories of data and corresponding metadata for designated data types are maintained
ID.AM-08 — Asset Life-Cycle Management: Systems, hardware, software, services, and data are managed throughout their life cycles

Using this Category in Current and Target Profiles

For a Current Profile, record which Subcategory outcomes are achieved, the scope of the assessment, and the evidence supporting the judgment. For a Target Profile, select the outcomes needed to meet risk management objectives and describe the target conditions.

Prioritize the resulting gaps by mission consequence, risk exposure, dependencies, obligations, implementation effort, and the value of the improvement. Record the owner and the evidence that will demonstrate closure.

Common failure modes

The following conditions can create the appearance of coverage without reliable outcome achievement. Treat them as hypotheses to test during assessments, exercises, and operational reviews.

Inventory coverage is assumed from one tool or administrative domain.
Records lack owners, business purpose, or criticality.
Cloud, SaaS, data, and supplier-provided services are omitted.
Retired assets and stale relationships remain active.

Source, scope, and attribution

The Category identifier, name, description, and Subcategory outcomes are from NIST CSWP 29. Bare Metal Cyber’s implementation, evidence, failure-mode, and Profile guidance is original educational material.

The CSF describes outcomes, not mandatory implementation steps. Use NIST’s current online Implementation Examples and Informative References when selecting practices and controls for a specific environment.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Search Bare Metal Cyber