Description
Organisations actively and passively detect assets that may not be registered in the CMDB, both within the network and outside. Discrepancies in CMDB and detected assets are resolved.
Specification
Active scanning of the network devices needs to take place. Passive scanning can take place through DNS or DHCP logs for example. Organisations may use other means to detect assets outside of the network, for example through registrations of domain names using organisation email addresses or detecting the use of organisational logos.
ISO 27001 & 27002:2022
A8.1.1
SURF toetsingskader informatiebeveiliging (NBA-volwassenheidsmodel)
CO.01 Identificatie en onderhoud van configuratie-items
CO.02 Configuratie database en baseline