Requirement
The cybersecurity requirements for managing information and technology assets must be implemented.
Control Implementation Guidelines
- All cybersecurity requirements to manage information and technology assets of the organization, which may include the following
- Approved cybersecurity requirements for the management of information and technology assets in the organization must be implemented, including but not limited to, classifying all information and technology assets of the organization, documenting and approving them in an approved and official document (e.g., a documented record for the management of the organization's information and technology assets), as well as encoding all information and technology assets of the organization based on the approved classification of the organization's information and technology assets
- Specific procedures for dealing with assets based on their classification and in accordance with the relevant laws and regulations must be established
Expected Deliverables
- Documents that confirm the implementation of cybersecurity requirements related to information and technology asset management as documented in the policy
- An action plan to implement the cybersecurity requirements of information and technology assets management
- A documented and up-to-date record of all information and technology assets (e.g., Excel spreadsheet or displayed through automated means using solutions such as CMDB) must be provided
- Specific procedures for dealing with assets based on their classification and in accordance with the relevant laws and regulations
