4.4.3.2
Cyber Security Risk Assessment
Information Systems and Assets List (Registry)
The organization shall develop and maintain an asset register of its information systems and IT assets, including records showing management’s understanding of the assets’ purpose. For any information systems and assets not included in their implementation of the baseline cyber security controls, the organization shall document all instances where they make the business decision not to do so.
-
5.9 Inventory of Information and Other Associated Assets: Create and maintain an inventory of information and associated assets, including owners.
8.6 Capacity Management: Monitor and adjust resource usage according to current and anticipated capacity needs.
-
3.5.1 Identify system users, processes acting on behalf of users, and devices.
3.11.1 Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
3.11.3 Remediate vulnerabilities in accordance with risk assessments.
3.12.2 Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
-
3.5.1 Identify system users, processes acting on behalf of users, and devices.
3.11.1 Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
3.11.3 Remediate vulnerabilities in accordance with risk assessments.
3.12.2 Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.