What NIST CSF 2.0 and the CIS Controls Ask of an Asset Inventory

Security frameworks rarely agree on everything, but they agree on where to start: you cannot protect what you have not listed. This note summarizes what two widely used frameworks ask of an asset inventory, and how to map those asks to features you can check in a vendor's documentation. It is a reading guide, not a compliance assessment.

Where does asset management sit in NIST CSF 2.0?

The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Asset management is a category of the Identify function, labelled ID.AM. Its outcomes include:

• Inventories of hardware managed by the organization are maintained (ID.AM-01).
• Inventories of software, services and systems managed by the organization are maintained (ID.AM-02).
• Representations of authorized network communication and internal and external data flows are maintained (ID.AM-03).
• Inventories of services provided by suppliers are maintained (ID.AM-04).
• Assets are prioritized based on classification, criticality, resources and impact on the mission (ID.AM-05).
• Inventories of data and corresponding metadata for designated data types are maintained (ID.AM-07).
• Systems, hardware, software, services and data are managed throughout their life cycles (ID.AM-08).

The framework describes outcomes, not tools. It leaves the method to the organization, which is why NIST also publishes informative references that map CSF outcomes to other standards. On 25 August 2026 NIST finalized SP 1347, a quick-start guide explaining how those informative references work, with sample use cases.

What do CIS Controls 1 and 2 ask for?

The CIS Controls, published by the Center for Internet Security, start with two inventory controls. Control 1, Inventory and Control of Enterprise Assets, asks for a detailed inventory of all enterprise assets, a process for addressing unauthorized assets, an active discovery tool, DHCP logging to update the inventory and a passive discovery tool. Control 2, Inventory and Control of Software Assets, asks for a software inventory, checks that authorized software is still supported, a process for unauthorized software, automated software inventory tools, and allowlisting of authorized software, libraries and scripts.

Read together, the two controls describe the same layered approach our lesson on discovery methods covers: active and passive discovery to find what exists, and an inventory that is kept current rather than audited once a year.

How do the frameworks map to features you can check?

• Hardware and software inventories (ID.AM-01, ID.AM-02, CIS 1 and 2): which asset classes the tool documents. Our coverage grid records this for seven classes and seven tools.
• Active and passive discovery (CIS 1): runZero, Lansweeper and Armis document passive methods; runZero, Lansweeper, Device42 and ServiceNow Discovery document agentless scanning.
• Data flows (ID.AM-03): dependency mapping and network views. Device42 generates dependency visuals, and JupiterOne's security graph maps relationships between assets.
• Prioritization (ID.AM-05): asset criticality rules and the ability to query by business unit, environment and data. See our lesson on reading coverage gaps.
• Life cycle (ID.AM-08): lifecycle records and workflows. Oomnitza automates onboarding, refresh, recovery and license reclamation, and ServiceNow runs change and request processes on its CMDB.
• Unauthorized assets (CIS 1 and 2): a way to act on what the inventory finds, which is our remediation and write-back criterion. See how write-back closes the loop.

What about OT?

For operational technology, NIST's specific guidance is SP 800-82. On 21 September 2026 NIST released the initial public draft of Revision 4, which expands guidance on OT security controls including asset management and network monitoring; comments are open until 30 November 2026. Our OT asset inventory note covers what the draft means for inventory work.

How should you use this in an evaluation?

• Pick the outcomes your organization reports against, and write each one as a question for the vendor: "Show us how the inventory maintains ID.AM-02 for SaaS apps."
• Ask for the evidence a tool would produce for an auditor: a dated inventory export, a list of unauthorized assets and what happened to them, and the owner of each.
• Check frequency. CIS asks for an inventory that is reviewed and updated regularly, and a process for unauthorized assets that runs often; a quarterly spreadsheet does not meet either.
• Remember that frameworks describe outcomes. A tool helps you meet them; it does not make you compliant on its own.