DerpGRC

    Topics in this domain

    Embedding Asset Management into Risk Governance

    Policies and assets · 1 min read

    Why it matters

    Asset inventory feeds risk assessment, classification, vulnerability management, continuity, third parties and incident response.

    An accurate inventory feeds almost every other risk activity. Unknown assets, including shadow IT, are unmanaged risk.

    Tracking the life cycle

    Acquire, register, deploy, maintain, dispose with data wiped and record updated.

    Risks from poor asset management

    GapResulting risk
    Unknown devices or cloud servicesUnpatched, unmonitored, unprotected
    No ownerNobody decides on risk or retirement
    Inventory not updated on changeWrong impact analysis during incidents
    Poor disposalData leaks from retired equipment

    Keeping it accurate

    • Link the inventory to change management and procurement.
    • Reconcile automated discovery results regularly.
    • Require owners to confirm their assets periodically.
    • Track disposals with certificates of destruction.

    Example. A discovery scan finds 180 devices missing from the inventory, including an old file server holding HR data. It hadn’t been patched in three years because nobody knew it existed.

    How the exam asks about it

    If the question asks…The answer is usually…
    GREATEST risk of an incomplete inventoryUnknown assets aren’t protected
    BEST way to keep the inventory currentLink it to change management and automated discovery
    Asset with no ownerAssign an owner before assessing or treating
    Disposal controlSecure wiping or destruction, with evidence

    In short

    • An accurate asset inventory feeds risk assessment, classification, vulnerability management, continuity and incident response.
    • Assets must be tracked through their whole life cycle, from acquisition to disposal.
    • Every asset needs an owner; ownerless assets are rarely patched, reviewed or retired.
    • Unknown assets, including shadow IT, are unmanaged risk.
    • Change management should update the inventory so it doesn't drift from reality.

    Exam traps

    • Treating the inventory as a one-off project rather than a continuous process.
    • Forgetting disposal: data left on retired equipment.
    • Allowing cloud services bought on credit cards to stay off the inventory.
    • Accepting an inventory without owners as complete.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 1 · Policies and assets

    Embedding Asset Management into Risk Governance

    How keeping the asset inventory accurate through its life cycle supports every other risk activity, and the risks that appear when assets are unknown, unowned or untracked.

    1 / 8