What it asks for. This control expects an inventory of information and other associated assets, including owners, to be developed and maintained. Its purpose is to identify the organisation's information and assets so that their security can be preserved and ownership assigned.
In practice. Good practice means an inventory that covers information, hardware, software, cloud services and other relevant assets, with owners responsible for protection. Automated discovery helps keep it accurate, and it is linked to classification, risk assessment and vulnerability management. Auditors expect the inventory, evidence that owners are assigned and records showing it is kept up to date.
Common gaps. Common gaps are inventories that cover devices but not information or cloud services, stale records and owners who do not know they are owners. Assets held by suppliers on the organisation's behalf are often missing.