Draft v0.1.06 of 6 frameworks
Asset and system inventory
Maintained inventory of hardware, software, data stores and system components in scope.
Where it appears
- SOC 2
CC6.1Logical access security (inventory of information assets is a point of focus)- PCI DSS 4.0
12.5.1Inventory of system components in scope for PCI DSS is maintained12.5.2PCI DSS scope is documented and confirmed at least every 12 months- NIST CSF 2.0
ID.AMAsset management- ISO 27001:2022
A.5.9Inventory of information and other associated assets- HIPAA Security Rule
164.310(d)(2)(iii)Accountability (record of hardware and media movements)- NIST 800-53 r5
CM-8System component inventory
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Current asset inventory export (hardware, software, cloud resources) with owners
- Evidence of periodic inventory reconciliation
- Network and data-flow diagrams
- Scope statement identifying in-scope systems
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0