| name | Asset Management (ID.AM)_asset-management |
| description | Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identifie |
| category | information-gathering |
| version | 2.0 |
| author | cyberstrike-official |
| tags | ["nist","csf","v2.0","asset management (id-am)","id","category"] |
| tech_stack | ["aws","azure","gcp","network"] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Asset Management (ID.AM) Asset Management
High-Level Description
Function: IDENTIFY (ID)
Framework: NIST Cybersecurity Framework v2.0
Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy
What to Check
How to Test
Step 1: Identify Current Profile
Determine the organization's current and target CSF profile tier for Asset Management (ID.AM).
Step 2: Assess Outcome Achievement
# Review organizational policies and procedures
# Check for evidence that Asset Management (ID.AM) outcome is met
# Interview stakeholders responsible for IDENTIFY
Step 3: Map to Technical Controls
Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Assess cloud security posture | cloud_audit_* tools |
| Manual Review | Policy and procedure review | Interviews and documentation |
Remediation Guide
Achieve the Asset Management (ID.AM) Asset Management outcome:
Assets (e.g., data, hardware, software, systems, facilities, services, people) that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy
Risk Assessment
| Finding | Severity | Impact |
|---|
| Asset Management (ID.AM) Asset Management outcome not achieved | Medium | IDENTIFY Function Gap |
CWE Categories
