What it asks for. Organisations should know every device that connects to their environment, whether physical, virtual, remote or cloud based, and act on anything that is unknown or unauthorised. The aim is that only managed assets have access, so that nothing escapes patching, monitoring or response.
In practice. A good programme keeps one authoritative inventory fed by several sources, such as DHCP logs, endpoint agents, network scans, cloud APIs and the MDM platform, and records owner, location and purpose for each asset. Unknown devices are reviewed on a fixed cadence and either enrolled, quarantined or removed. Auditors usually ask for the inventory itself, evidence of reconciliation between sources and tickets showing how rogue devices were handled.
Common gaps. Inventories often cover corporate laptops and servers but miss cloud workloads, IoT, OT and personal devices on guest networks. Many are also snapshots that go stale because nobody owns the reconciliation.