ASD Essentials IT.IDE-01.1 Use an Approved Inventory with Automated Discovery of New and Changed Assets
What it says
Use an approved asset inventory mechanism that supports automated discovery to detect new and changed physical and non-physical assets.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUses an approved inventory tool that automatically discovers new and changed assets, physical and non-physical, such as devices, software and cloud services.
The organisation uses an approved inventory tool that scans its networks and cloud services for anything new or changed. This automatic search is called discovery. It finds physical things, such as laptops and servers. It also finds non-physical ones, such as virtual servers, cloud services and software. To meet this, the tool covers every part of the network and runs on a set schedule. Each find is matched against the approved asset list.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Visibility and response: a capability domain, which ASD applies across all phases from the start.
Why it matters
Without working discovery, unknown devices, unmanaged virtual machines and unapproved cloud services appear or change unnoticed. They miss out on patching, locking down and monitoring, giving attackers an unwatched way in. Intrusions then take longer to spot and contain.
How to implement
The head of security, or the asset owner, should approve an inventory tool that finds assets automatically, recording its owner and scope.
It may combine network scans, software agents on devices and cloud links, or reuse a vulnerability scanner's discovery.
Network and infrastructure teams should extend discovery to every relevant network zone (each separate part of the network), including remote sites, wireless and networks used to manage equipment.
Record any zone not yet reached, with an owner and a plan.
Platform and cloud teams should connect the tool to virtual server hosts, cloud accounts and software management tools.
Then virtual machines, cloud services, containers (packaged apps) and software are found as automatically as physical devices.
The asset management owner should set a discovery schedule based on risk.
Configure each run to flag new assets and changes, such as replaced hardware or new software versions, and alert on failed runs.
The asset management team should match each run's results to the approved inventory with automatic rules, such as matching serial numbers or device names.
Record approved additions and changes, and send anything unexplained to security operations.
Keep it running
The asset management team works through each run's new and changed assets. It matches each one to an inventory record, or passes it to security operations as a possible cyber security event. This action applies organisation-wide, in every priority phase, so run the tool everywhere. Recheck coverage whenever a site, network zone or cloud environment is added. Watch for failed jobs: a skipped zone looks like one with no changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the record approving the inventory tool, with its owner and scope.
Look at
Whether an approved tool exists and discovers automatically, or asset lists are still kept by hand.
Good evidence
The approved tool is the one in use, and its automatic discovery is running.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the list of network zones and the discovery scope settings.
Look at
Compare the two for zones, sites or cloud environments that discovery misses with no recorded reason.
Good evidence
Discovery covers every applicable zone, and any gap is justified as not applicable.
- Check 3 of 5What an auditor asks for
Ask for
Ask for a recent discovery report by asset type, and a sample of newly added assets.
Look at
Whether physical and non-physical assets both appear, and samples were found automatically, not typed in.
Good evidence
All relevant physical and non-physical asset types are found automatically.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the discovery schedule and the history of recent runs.
Look at
Whether runs happened as scheduled, and failed runs were noticed and rerun.
Good evidence
Discovery runs at the set frequency, and any failed run is caught and rerun.
- Check 5 of 5What an auditor asks for
Ask for
Ask for matching records for recent runs, covering new and changed assets.
Look at
Whether sampled finds lead to inventory updates, and matching is routine rather than manual and occasional.
Good evidence
Each run's new and changed assets are matched to the inventory, and unknowns are investigated.
ASD indicators of good practice (6)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1No approved asset inventory mechanism is in place.
- NE-2Asset inventory records are maintained manually with no automated discovery capability.
Partially effective(2)
- PE-1An approved asset inventory mechanism is deployed but does not cover all network segments or asset types.
- PE-2Automated discovery scans to detect new and changed physical and non-physical assets occur on a schedule but reconciliation with the approved inventory is manual or inconsistent.
Fully effective(2)
- FE-1An approved asset inventory mechanism which supports automated discovery is deployed to cover all applicable assets and network segments.
- FE-2Discovery runs on a regular schedule defined by the organisation and new or changed physical or non-physical assets that are detected are reconciled with the approved inventory.
Mappings
Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.9.
IT.IDE-01.1 requires the organisation to use an approved asset inventory mechanism that supports automated discovery to detect new and changed physical and non-physical assets. This is a specific means of developing and maintaining the inventory of information and other associated assets required by ISO/IEC 27001 Annex A 5.9. Annex A 5.9 also requires asset owners to be recorded, while IT.IDE-01.1 adds the specific expectation of automated discovery.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-PA-ML1.1.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; E8-PA-ML1.1 overlaps on automated discovery, requiring it at least fortnightly to detect assets for later vulnerability scanning.
This control partially overlaps E8-PO-ML1.1.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; E8-PO-ML1.1 sets a minimum frequency for that discovery, at least fortnightly, to detect assets for subsequent vulnerability scanning.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-1493.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; ISM-1493 overlaps on software assets, requiring maintained and regularly verified software registers for workstations, servers, network devices and networked IT equipment.
This control partially overlaps ISM-1643.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; ISM-1643 sets what software registers record, the versions and patch histories of applications, drivers, operating systems and firmware.
This control partially overlaps ISM-1966.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; ISM-1966 overlaps at system level, with the CISO developing, maintaining and regularly verifying a register of the organisation's systems.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.