What it asks for. This Identify category asks the organisation to identify and manage the assets that let it achieve its business purpose, including hardware, software, services, data and systems, in line with their importance to objectives and risk strategy. ID.AM-2 in CSF 1.1 specifically covers inventories of software platforms and applications.
In practice. Inventories of hardware, software, services and data flows are maintained automatically where possible and include ownership and criticality. Software inventories record versions and support status and feed vulnerability management. Assets are prioritised by business value so that protection effort matches importance. Evidence includes current inventories, data flow diagrams and criticality ratings.
Common gaps. Inventories often omit SaaS, cloud services and shadow IT, and data assets are rarely mapped. Criticality ratings are frequently missing, so every asset is treated the same.