Skip to content
IDE-01 Asset identification
ASD EssentialsIT.IDE-01.2

ASD Essentials IT.IDE-01.2 Keep Current Records of Infrastructure, Software, Identities, Credentials and Data

What it says

Maintain current records of infrastructure, operating systems, applications, identities, credentials and data assets.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Keeps current, accurate records of infrastructure, operating systems, applications, user and system accounts, credentials (such as keys and certificates) and data.

The organisation keeps an up-to-date list of what it runs. That covers infrastructure, such as servers and network gear, plus operating systems, applications, user and system accounts (identities), and data. Credentials, such as keys and certificates, are listed by name and owner, never the secret itself. To meet this, a set process updates records as things change. Gaps are fixed on time. At each review, the records match what is running, within agreed error limits.

Where this action applies

What's in each domain?

ASD orders the work by domain: apply this action to each ticked domain, phase by phase.

Phase 1
Phase 2
Phase 3

Why it matters

Anything missing from the records, such as an unpatched internet-facing device, a forgotten system account or an unknown key, misses patching, monitoring and access reviews. It gives attackers an unwatched way in. Out-of-date records also slow the response to an incident.

How to implement

  1. The asset management lead should set a record standard for six types: infrastructure, operating systems, applications, identities, credentials and data.

    Name each type's master source, such as the HR system for staff, and required fields like owner and ASD domain.

  2. The head of security should approve a process for finding, recording, reviewing and updating asset records, with an owner for each asset type.

    Set the review cycle, agreed limits for completeness and accuracy, and risk-based fix timeframes.

  3. Identity and access administrators should update user, admin and system account records whenever staff join, move or leave.

    Record each credential's owner, linked account, storage place (such as a password vault) and expiry, never the secret itself.

  4. System owners should make a record update a required step in every build, change and retirement.

    Data owners should register each data store with its owner, location and sensitivity, updating it when data is moved, copied or deleted.

  5. The asset management lead should match records against discovery results, directory and cloud exports and data store lists at each review.

    Log every gap with an owner and due date, and clear the highest-risk gaps first.

Keep it running

Build record updates into everyday work: builds, changes, installs, staff starting, moving and leaving, new keys and certificates, new data stores and retirements. Deal with new or mismatched assets within the set timeframes. Record which ASD domains, such as Identity services, each asset supports. Bring records up to standard in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems and staff devices.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for current record extracts for all six asset types, with owner and ASD domain fields.

    Look at

    Whether any type has no records (often accounts, credentials and data), or any ASD domain has few records.

    Good evidence

    All six asset types are recorded across every relevant ASD domain, complete within agreed limits.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the process for finding, recording, reviewing and updating asset records.

    Look at

    Whether it is informal, skips a step, or leaves schedules, limits or timeframes undefined.

    Good evidence

    An approved process sets owners, a review schedule, limits and risk-based timeframes, and is followed.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for the log of gaps, errors and new assets since the last review.

    Look at

    Whether items sit unchecked or overdue, especially for internet-facing and sign-in systems.

    Good evidence

    Every item is assessed and fixed within risk-based timeframes, highest risk first.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for the results of recent scheduled inventory updates and the record changes made.

    Look at

    Whether runs finished on schedule but their differences were matched late or never.

    Good evidence

    Each run is matched within the set period, so records are accurate at every review.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for a sample of changes between reviews, plus live directory and cloud console lists.

    Look at

    Whether each change reached the records promptly, and live assets trace to records and back.

    Good evidence

    Changes are recorded within risk-based timeframes, and the records match what is really running.

ASD indicators of good practice (6)

The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".

Not effective(2)

  • NE-1A maintained record of infrastructure, operating systems, applications, identities, credentials and data assets has not been established.
  • NE-2There is no defined process for identifying, recording, reviewing and updating asset records.

Partially effective(2)

  • PE-1Asset records are maintained, but identified omissions, inaccuracies or newly discovered assets are not triaged and addressed within the timeframes or tolerances defined by the organisation.
  • PE-2A process to update the asset inventory runs on a schedule but the results are not reconciled or updated within a period defined by the organisation.

Fully effective(2)

  • FE-1At each scheduled review or update, records of infrastructure, operating systems, applications, identities, credentials and data assets are complete and accurate within the tolerances defined by the organisation.
  • FE-2A defined process identifies changes and newly discovered assets between scheduled reviews, and ensures that records are reviewed, reconciled and updated within timeframes commensurate with the associated cyber security risk.

Mappings

Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which asks for the same thing.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.5.9Inventory management of information and associated assetsEquivalent
  • A.5.16Identity life cycle managementPartially overlaps
ASD ISM

ASD Information Security Manual: 4 mappings

  • ISM-1493Maintain and Verify Software RegistersPartially overlaps
  • ISM-1633Determine System Boundary, Criticality and Security ObjectivesPartially overlaps
  • ISM-1643Maintain Detailed Software Version and Patch RecordsPartially overlaps
  • ISM-1966CISO Manages and Verifies System RegisterPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.