Scope Enterprise Active

Asset Management

To manage the lifecycle of technology assets from procurement to disposal.

Domain ID
DOM-007
Domain Code
AST
Business Owner
IT Operations

Domain Overview

AST · Full Domain Profile
Short Overview

Establishes the processes for identifying, classifying, and managing organizational assets, ensuring visibility into what assets exist and their security requirements.

Description

Provides a comprehensive view of all assets (hardware, software, data, cloud services). Includes inventory management, ownership, and lifecycle tracking.

Why This Domain Matters

Shadow IT and decentralized procurement lead to unknown assets, creating security blind spots and compliance gaps that cannot be effectively managed.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        AST · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        8 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        AST-001 Asset Inventory Management Establishes a comprehensive, governed as...
        Administrative
        Preventive
        		 High Active 📋 10 Reqs View →
        AST-002 Asset Classification & Criticality Establishes consistent asset classificat...
        Administrative
        Detective
        		 High Active 📋 10 Reqs View →
        AST-003 Asset Ownership Establishes clear ownership assignments...
        Administrative
        Preventive
        		 High Active 📋 10 Reqs View →
        AST-004 Asset Lifecycle Management Establishes complete asset lifecycle man...
        Administrative
        Preventive
        		 High Active 📋 10 Reqs View →
        AST-005 Secure Asset Disposal & Reuse Establishes secure processes for asset d...
        Administrative
        Preventive
        		 High Active 📋 10 Reqs View →
        AST-006 Authorized & Approved Assets Establishes and maintains approved inven...
        Administrative
        Preventive
        		 High Active 📋 10 Reqs View →
        AST-007 Automated Asset Discovery & Unauthorized Asset Detection Establishes automated asset discovery, c...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →
        AST-008 Software License Management Establishes comprehensive software licen...
        Administrative
        Detective
        		 Medium Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        80 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        AST-001-R001 Asset Inventory Framework The organization shall establish an asse... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R002 Asset Identification The organization shall identify all asse... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R003 Asset Registration The organization shall register identifi... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R004 Asset Attribute Management The organization shall manage asset attr... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R005 Asset Inventory Maintenance The organization shall maintain the asse... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R006 Asset Inventory Reconciliation The organization shall reconcile the ass... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R007 Asset Inventory Validation The organization shall validate the accu... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R008 Asset Inventory Reporting The organization shall report on the ass... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R009 Asset Inventory Review The organization shall conduct periodic... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-001-R010 Asset Inventory Continuous Improvement The organization shall drive ongoing enh... AST-001 Asset Inventory Management IT Asset Management, CISO, Asset Owners View ↗
        AST-002-R001 Asset Classification Framework The organization shall establish an asse... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R002 Classification Criteria The organization shall define classifica... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R003 Asset Criticality Assessment The organization shall conduct criticali... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R004 Asset Classification Assignment The organization shall assign classifica... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R005 Asset Labeling The organization shall label assets with... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R006 Classification Review The organization shall conduct periodic... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R007 Classification Change Management The organization shall manage changes to... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R008 Classification Monitoring The organization shall monitor asset cla... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R009 Classification Reporting The organization shall report on asset c... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-002-R010 Classification Continuous Improvement The organization shall drive ongoing enh... AST-002 Asset Classification & Critica... IT Asset Management, Information Security, Asset Owners View ↗
        AST-003-R001 Asset Ownership Framework The organization shall establish an asse... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R002 Asset Owner Assignment The organization shall assign explicit o... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R003 Ownership Responsibilities The organization shall clearly define an... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R004 Ownership Accountability The organization shall establish account... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R005 Ownership Transfer The organization shall transfer asset ow... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R006 Ownership Validation The organization shall validate asset ow... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R007 Ownership Review The organization shall conduct periodic... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R008 Ownership Documentation The organization shall maintain comprehe... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R009 Ownership Reporting The organization shall report on asset o... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-003-R010 Ownership Continuous Improvement The organization shall drive ongoing enh... AST-003 Asset Ownership IT Asset Management, Business Owners, Asset Owners View ↗
        AST-004-R001 Asset Lifecycle Framework The organization shall establish an asse... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R002 Asset Acquisition and Procurement The organization shall acquire and procu... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R003 Asset Deployment The organization shall deploy assets, en... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R004 Asset Configuration and Commissioning The organization shall configure and com... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R005 Asset Maintenance The organization shall maintain assets t... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R006 Asset Relocation and Transfer The organization shall relocate and tran... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R007 Asset Retirement The organization shall retire assets at... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R008 Asset Lifecycle Monitoring The organization shall monitor asset lif... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R009 Asset Lifecycle Review The organization shall conduct periodic... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-004-R010 Asset Lifecycle Continuous Improvement The organization shall drive ongoing enh... AST-004 Asset Lifecycle Management IT Asset Management, Procurement, IT Operations, Asset Owners View ↗
        AST-005-R001 Asset Disposal Framework The organization shall establish an asse... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R002 Disposal Authorization The organization shall authorize the dis... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R003 Secure Data Sanitization The organization shall securely sanitize... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R004 Secure Asset Destruction The organization shall securely destroy... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R005 Asset Reuse Management The organization shall manage the reuse... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R006 Chain of Custody Management The organization shall manage the chain... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R007 Disposal Verification The organization shall verify that asset... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R008 Disposal Documentation The organization shall maintain comprehe... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R009 Disposal Review The organization shall conduct periodic... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-005-R010 Disposal Continuous Improvement The organization shall drive ongoing enh... AST-005 Secure Asset Disposal & Reuse IT Asset Management, Information Security, Records Management View ↗
        AST-006-R001 Authorized Asset Framework The organization shall establish an auth... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R002 Approved Hardware Management The organization shall maintain an appro... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R003 Approved Software Management The organization shall maintain an appro... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R004 Asset Authorization Process The organization shall authorize new ass... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R005 Unauthorized Asset Exception Management The organization shall manage exceptions... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R006 Approved Asset Repository The organization shall establish and mai... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R007 Approved Asset Compliance Monitoring The organization shall monitor approved... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R008 Authorized Asset Review The organization shall conduct periodic... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R009 Authorized Asset Reporting The organization shall report on authori... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-006-R010 Authorized Asset Continuous Improvement The organization shall drive ongoing enh... AST-006 Authorized & Approved Assets IT Asset Management, CISO, IT Operations View ↗
        AST-007-R001 Automated Discovery Framework The organization shall establish an auto... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R002 Asset Discovery Configuration The organization shall configure automat... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R003 Continuous Asset Discovery The organization shall conduct continuou... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R004 Unauthorized Asset Detection The organization shall use automated dis... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R005 Asset Reconciliation The organization shall reconcile discove... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R006 Discovery Validation The organization shall validate automate... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R007 Discovery Monitoring The organization shall monitor automated... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R008 Discovery Reporting The organization shall report on automat... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R009 Discovery Review The organization shall conduct periodic... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-007-R010 Discovery Continuous Improvement The organization shall drive ongoing enh... AST-007 Automated Asset Discovery & Un... IT Asset Management, Security Operations, Network Operations View ↗
        AST-008-R001 Software License Management Framework The organization shall establish a softw... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R002 License Inventory Management The organization shall maintain a compre... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R003 License Allocation and Assignment The organization shall allocate and assi... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R004 License Usage Monitoring The organization shall monitor software... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R005 License Compliance Verification The organization shall periodically veri... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R006 License Renewal Management The organization shall manage license re... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R007 Vendor License Reconciliation The organization shall reconcile interna... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R008 License Reporting The organization shall report on softwar... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R009 License Review The organization shall conduct periodic... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗
        AST-008-R010 License Management Continuous Improvement The organization shall drive ongoing enh... AST-008 Software License Management IT Asset Management, Software Asset Management, Procurement View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED ISO 19770-1 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST-CSF NIST CSF (ID.AM) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        COBIT2019 COBIT (APO03) COBIT is an enterprise governance and ma...
        COBIT
        Governance Framework
        		 v2019 View →
        MAPPED ITIL Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED ISO 27001 (Clause A.8.1) Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control f...
        NIST
        Control Catalog
        		 vRev. 5 View →