3.5.1
3.5.1
Identify system users, processes acting on behalf of users, and devices.
-
4.4.3.2 The organization shall develop and maintain a list of their information systems and assets. For any information systems and assets not included in their implementation of the baseline cyber security controls, the organization shall document all instances where they make the business decision not to do so.