{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/asset-inventory","url":{"en":"https://atlas.maintz.dev/en/terms/security/asset-inventory/","da":"https://atlas.maintz.dev/da/terms/security/asset-inventory/"},"term":{"en":"Asset inventory","da":"Aktivfortegnelse (asset inventory)"},"aka":{"en":["IT asset inventory","asset register"],"da":["asset inventory","aktivliste"]},"domain":["security"],"cluster":"controls","layer":"governance","status":"current","summary":{"en":"One complete, up-to-date list of the organisation's computers, devices, systems and software.","da":"En samlet, opdateret liste over virksomhedens computere, enheder, systemer og software."},"body":{"formal":{"en":"A maintained record of every hardware and software item the organisation owns or runs, with an owner, location and purpose for each, kept current as things are added or removed.","da":"En vedligeholdt fortegnelse over alt udstyr og al software, virksomheden ejer eller driver, med ejer, placering og formål for hver enkelt, som holdes ajour, når noget tilføjes eller fjernes."},"plain":{"en":"Like the list a household makes for home insurance - you cannot protect or claim for what you do not know you have.","da":"Som den liste over ting i hjemmet, en familie laver til forsikringen - man kan ikke beskytte eller få erstatning for noget, man ikke ved, man har."},"inPractice":{"en":"At a small water utility, the IT lead checks the office network and finds three laptops and a file-sharing app nobody had listed; each gets an owner and joins the same update routine as everything else.","da":"Hos et vandværk tjekker den IT-ansvarlige kontorets netværk og finder tre bærbare og en fildelingsapp, som ingen havde registreret; hver får en ejer og kommer ind under samme opdateringsrutine som resten."},"whyItMatters":{"en":"Every other control depends on it - forgotten machines are never updated or watched, and that is exactly where attackers get in.","da":"Alle andre kontroller afhænger af den - glemte maskiner bliver hverken opdateret eller overvåget, og det er netop dér, angribere kommer ind."}},"deepDive":{"en":"An asset inventory is a reconciliation problem rather than a list-keeping problem. No single source sees everything, so mature programmes merge several: directory services (Active Directory, Entra ID), MDM/UEM and EDR agent consoles, DHCP and DNS logs, switch ARP and CAM tables, active network discovery scans, passive traffic analysis (the only safe method on many OT networks, where active probing can crash PLCs), cloud provider APIs, virtualisation managers and purchasing records. Each record is keyed on something stable - serial number, MAC address, cloud instance ID, agent ID - and the interesting output is the delta: devices seen on the network but not in the inventory are unmanaged or rogue, and inventory entries not seen for weeks are stale or lost. Tools that do this correlation are marketed as cyber asset attack surface management (CAASM).\n\nCIS Controls v8 puts this first for a reason. Control 1 (enterprise assets) asks for a detailed inventory reviewed at least bi-annually (Safeguard 1.1) and a process to deal with unauthorised assets weekly (1.2); Control 2 does the same for software, including an allowlist-based approach at higher Implementation Groups. ISO/IEC 27002:2022 control 5.9 (inventory of information and other associated assets) additionally requires an identified owner for each asset, and NIS2 Art. 21(2)(i) lists asset management among the mandatory measures. The owner field matters more than it looks: without it, vulnerability findings, end-of-life decisions and risk acceptances have nobody to route to.\n\nSoftware inventory has moved from \"which applications are installed\" towards component-level transparency. A software bill of materials (SBOM), in SPDX or CycloneDX format, lists the libraries inside a product, which is what lets an organisation answer \"where do we run a vulnerable Log4j version?\" in hours rather than weeks. The EU Cyber Resilience Act makes SBOMs a manufacturer obligation for products with digital elements, on a timeline that runs to the end of 2027.\n\nCommon failure modes: treating the CMDB (a configuration model built for IT service management, with relationships between configuration items) as a security inventory without checking its completeness; missing ephemeral cloud workloads and containers that live for minutes; ignoring SaaS subscriptions bought on credit cards (shadow IT); and forgetting non-traditional endpoints such as printers, IP cameras, building-management controllers and conference-room systems. The measure of quality is coverage - the share of observed devices that are known and owned - not the length of the list.","da":"En aktivfortegnelse er i virkeligheden et afstemningsproblem snarere end et spørgsmål om at føre en liste. Ingen enkelt kilde ser alt, så modne programmer fletter flere sammen: katalogtjenester (Active Directory, Entra ID), MDM/UEM- og EDR-konsoller, DHCP- og DNS-logs, switchenes ARP- og CAM-tabeller, aktive netværksscanninger, passiv trafikanalyse (den eneste sikre metode på mange OT-netværk, hvor aktiv scanning kan få PLC'er til at gå ned), cloududbydernes API'er, virtualiseringsplatforme og indkøbsdata. Hver post nøgles på noget stabilt - serienummer, MAC-adresse, cloud-instans-ID, agent-ID - og det interessante resultat er differencen: enheder, der ses på netværket, men ikke står i fortegnelsen, er uadministrerede eller uautoriserede, og poster, der ikke er set i ugevis, er forældede eller forsvundne. Værktøjer, der laver denne korrelation, sælges under betegnelsen cyber asset attack surface management (CAASM).\n\nCIS Controls v8 placerer emnet først med god grund. Control 1 (virksomhedens aktiver) kræver en detaljeret fortegnelse, der gennemgås mindst to gange om året (Safeguard 1.1), og en proces, der håndterer uautoriserede aktiver ugentligt (1.2); Control 2 gør det samme for software, på de højere Implementation Groups med allowlisting. ISO/IEC 27002:2022 kontrol 5.9 (fortegnelse over information og andre tilknyttede aktiver) kræver desuden en udpeget ejer for hvert aktiv, og NIS2 art. 21, stk. 2, litra i, nævner forvaltning af aktiver blandt de obligatoriske foranstaltninger. Ejerfeltet betyder mere, end det ser ud til: uden det har sårbarhedsfund, end-of-life-beslutninger og risikoaccept ingen modtager.\n\nSoftwarefortegnelsen har bevæget sig fra \"hvilke programmer er installeret\" mod gennemsigtighed på komponentniveau. En software bill of materials (SBOM) i SPDX- eller CycloneDX-format viser bibliotekerne inde i et produkt og gør det muligt at svare på \"hvor kører vi en sårbar Log4j-version?\" på timer frem for uger. EU's Cyber Resilience Act gør SBOM til en pligt for producenter af produkter med digitale elementer, med en tidsplan, der løber frem til udgangen af 2027.\n\nTypiske fejl: at bruge CMDB'en (en konfigurationsmodel bygget til IT-servicestyring med relationer mellem konfigurationselementer) som sikkerhedsfortegnelse uden at efterprøve dens fuldstændighed; at overse kortlivede cloud-workloads og containere, der kun eksisterer i minutter; at ignorere SaaS-abonnementer købt på firmakort (skygge-IT); og at glemme utraditionelle endpoints som printere, IP-kameraer, bygningsautomatik og mødelokaleudstyr. Kvaliteten måles på dækning - andelen af observerede enheder, der er kendte og har en ejer - ikke på listens længde."},"howTo":{"steps":{"en":["Name an owner for the inventory and agree which asset types it covers - end-user devices, servers, network gear, cloud resources, IoT and OT devices, software and SaaS.","Define the minimum fields for each record, such as a unique ID, type, owner, location, purpose, data sensitivity and whether the asset is managed.","Collect data from several sources - directory, MDM and EDR consoles, DHCP logs, network scans, cloud APIs and purchasing - and merge them on stable keys like serial number or instance ID.","Give every asset a named owner and link it to the systems and data it supports.","Build a software inventory with version and support status, and keep a list of approved software.","Compare what is seen on the network with the inventory, and deal with unknown devices at least weekly and unapproved software at least monthly (CIS Safeguards 1.2 and 2.3).","Tie the inventory into procurement, onboarding and decommissioning, so assets are added and removed as part of normal work.","Review the whole inventory at least twice a year and measure coverage as the share of observed devices that are known and have an owner."],"da":["Udpeg en ejer af fortegnelsen, og aftal, hvilke typer aktiver den dækker - brugerenheder, servere, netværksudstyr, cloudressourcer, IoT- og OT-enheder, software og SaaS.","Fastlæg minimumsfelterne for hver post, fx et entydigt id, type, ejer, placering, formål, datas følsomhed og om aktivet er administreret.","Indsaml data fra flere kilder - katalogtjeneste, MDM- og EDR-konsoller, DHCP-logs, netværksscanninger, cloud-API'er og indkøb - og flet dem på stabile nøgler som serienummer eller instans-id.","Giv hvert aktiv en navngiven ejer, og knyt det til de systemer og data, det understøtter.","Opbyg en softwarefortegnelse med version og supportstatus, og hold en liste over godkendt software.","Sammenlign det, der ses på netværket, med fortegnelsen, og håndtér ukendte enheder mindst ugentligt og ikke-godkendt software mindst månedligt (CIS Safeguard 1.2 og 2.3).","Kobl fortegnelsen til indkøb, onboarding og udfasning, så aktiver tilføjes og fjernes som en del af det normale arbejde.","Gennemgå hele fortegnelsen mindst to gange om året, og mål dækningen som andelen af observerede enheder, der er kendte og har en ejer."]},"pitfalls":{"en":["Relying on a single source, such as the CMDB or the purchasing list, without checking it against what is on the network.","Forgetting cloud workloads, SaaS bought on company cards, printers, cameras and OT devices.","Keeping records without an owner, so vulnerabilities and end-of-life decisions have nobody to go to.","Building the list once as a project and never updating it."],"da":["At stole på én kilde, fx CMDB'en eller indkøbslisten, uden at holde den op mod det, der faktisk er på netværket.","At glemme cloud-workloads, SaaS købt på firmakort, printere, kameraer og OT-enheder.","At have poster uden ejer, så sårbarheder og end-of-life-beslutninger ikke har nogen modtager.","At lave listen én gang som et projekt og aldrig opdatere den."]},"guides":[{"title":"CIS Critical Security Control 1 - Inventory and Control of Enterprise Assets","url":"https://www.cisecurity.org/controls/inventory-and-control-of-enterprise-assets","publisher":"Center for Internet Security","tier":"standard"},{"title":"CIS Critical Security Control 2 - Inventory and Control of Software Assets","url":"https://www.cisecurity.org/controls/inventory-and-control-of-software-assets","publisher":"Center for Internet Security","tier":"standard"},{"title":"NIST SP 1800-5 - IT Asset Management","url":"https://csrc.nist.gov/pubs/sp/1800/5/final","publisher":"NIST","tier":"standard"},{"title":"10 Steps to Cyber Security - Asset management","url":"https://www.ncsc.gov.uk/collection/10-steps/asset-management","publisher":"NCSC UK","tier":"official-doc"},{"title":"1. Få overblik over vigtige data og systemer","url":"https://sikkerdigital.dk/virksomhed/syv-raad-om-it-sikkerhed/1-faa-overblik-over-vigtige-data-og-systemer","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"}]},"edges":[{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/shadow-it","why":{"en":"Regularly comparing what is found against the list exposes apps and devices nobody approved.","da":"Når man jævnligt sammenligner det fundne med listen, afsløres apps og enheder, som ingen har godkendt."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/endpoint","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/vulnerability-scanning","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"CIS Critical Security Controls v8 - Controls 1 and 2","tier":"standard","publisher":"Center for Internet Security"}],"draft":true}