Assets and their Importance

Intent of this standard

Organisations need to protect their assets. There are many asset types including:

• intellectual property and customer data,
• information technology (IT) and operational technology (OT) assets (hardware and software), and 
• people and their skills.

This standard focuses on identifying assets in a cyber security context and understanding their importance so that the appropriate controls to achieve security objectives can be applied. This includes third-party managed services that process and protect organisational assets.

Implementing this standard will help to identify and prioritise assets that provide and support critical functions to an organisation using a risk-based approach. 

This standard intends to address the following areas.

Identification of assets

Understanding which assets are critical to the organisation is the first step before identifying and implementing controls to manage the confidentiality, integrity, and availability of these assets.

Organisations must also understand which dependencies exist between assets located either on-site or externally. 

Establishing an asset life cycle management process

Having a good asset management process will help in the deliberate and active management of an asset throughout its life while accounting for its total cost of ownership. This may include legacy assets and as-a-service (aaS) offerings. An organisation must ensure assets nearing the end of their supportable life are replaced before they are no longer supportable.

Risk management

Organisations will be able to apply appropriate controls once levels of risk have been identified. Implementing this standard will require organisations to undertake a risk assessment.

Identifying and understanding assets and their importance in your organisation will enable the application of appropriate security controls, which may include but is not limited to:

• monitoring,
• patch management, and
• hardening.

It may also identify opportunities for procedural changes in processes for:

• incident management,
• data recovery, and
• response planning.

Patching standard

Data recovery standard

Response planning standard

Minimum capability maturity level

We have established criteria within a maturity model to provide clarity, including the expected minimum implementation level, which is CS-CMM 2.

Cyber Security Capability Maturity Model

The requirements are intended to meet and comply with each respective level of maturity. The levels provide a pathway that can be used by agencies to assess themselves against, with a view to improving maturity over time.

Each maturity level builds on the requirement from the preceding level.

Below are the requirements for each capability maturity level for this Standard.

Focus areas

Focus areas are applicable to the standard and are provided as a guide and not an exhaustive list. Each agency is best placed to identify areas of relevance.

Focus areas for this standard are:

• Corporate network systems.
• Cloud services (private, semi-public, public), as-a-service delivery, internal-facing systems.
• External-facing/internet-facing systems.

Suggested actions

The following list is not exhaustive. Organisations should identify which actions are appropriate to implement the standard based on their current maturity level. However, the following actions follow good practice guidelines:

• Establishing an asset lifecycle management policy and procedure(s).
• Identifying and maintaining a current asset inventory - for hardware and software - that has the appropriate minimum configuration items listed, such as:
  • application name,
  • business owner,
  • licensing model,
  • server/instance names,
  • IP address & URL (if web-based),
  • vital dependencies (i.e. other systems, networks, etc.), and
  • other supporting information such as C&A artefacts and privacy impact assessments.

• Establishing business owners for business-critical systems, software, and applications, and ensuring they fully understand their role and responsibilities as an owner.

• Ensuring that procurement policies satisfy security requirements prior to asset acquisitions.

• Procurement of assets is not typically allowed via corporate credit cards. Where this is permitted, ensure asset invoices are reconciled to procurement tools.

• Continuous monitoring is in place to detect, manage, and track the movement and usage of assets, including oversight of the supply chain.

• Identifying key personnel involved in the management of assets and systems to enable the identification of single points of failure.

Key dependencies

To implement this standard, there are likely to be requisite measures or technologies in place.

A number of dependencies apply to multiple standards. In general, these dependencies are less technology-specific and relate to business processes.

Key dependencies for this standard include:

• An asset management tool exists, including resourcing to operate the tool.
• A risk management strategy that includes a defined acceptable risk level exists.
• A defined governance process (e.g. business impact analysis) for rating applications or systems as critical.
• Sufficient capacity and capability to risk-assess critical assets for vulnerabilities and weaknesses.
• A procurement process involves asset management.
• Asset identification methodology is in place.
• Asset governance model that accounts for procurement, onboarding, deployment, recovery, and disposal of assets.
• Software dependencies have been identified and managed.

Measurable outcomes

To establish whether the standard is being implemented, the outcomes are a tool an organisation may wish (or already have in place) to measure to help make this determination.

The outcomes have been designed to align with the requirements contained in the maturity level.

Outcomes for this standard include:

• An asset registry is kept current and regularly reviewed against risks.
• Critical assets, and all dependencies (e.g. third-party software libraries) to operate these, have been identified and regularly reviewed.
• Organisations have a current asset inventory (e.g. hardware, software, licences, versions numbers).
• Organisations embed asset management processes and procedures into their procurement/sourcing process.
• Organisations have asset life cycle management policies and procedures, ensuring that all assets are always supportable.
• Business owners are assigned for critical software and applications, and they are also responsible for documenting and communicating any changes in the asset to all relevant support units or key stakeholders.
• Demonstrate an understanding of the total cost of ownership (TCO) of assets for future years.