Habit 04 of 18
Know what you have
A list of devices and data
You know which laptops, phones, accounts and data you have.
You cannot protect what you do not know you have. Most incidents start with a forgotten laptop, account or system.
Switch it on in the map Counts towards 4 articles, controls and categories
§1 How to do it
How a small firm does it
- Keep one list of laptops, phones, servers, cloud services and important accounts.
- Give each one an owner.
- Note where important data lives, especially personal data.
- Update it when people join or leave, and check it twice a year.
Evidence that shows it
- The list itself, with owners and a last-updated date
- Your record of processing, if you handle personal data routinely
Ireland: NCSC Ireland guidance on asset management applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
21(2)(i) People security, access control and assets · subset
human resources security, access control policies and asset management
Asset management is named in this measure. An inventory of devices and data is one part of it.
Read Art 21(2)(i) on EUR-Lex
General Data Protection Regulation 1 item
-
Art 30 Records of processing · supports
Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility.
Knowing what data you hold is the starting point for a record of processing. Article 30 asks for more, such as purposes, recipients and how long data is kept. Firms under 250 staff are exempt only if their processing is occasional, low-risk and avoids special-category data, so most small firms still need a record (Art 30(5)).
Read Art 30(1) on EUR-Lex
ISO/IEC 27001:2022 1 item
-
A.5.9 Knowing your information and assets · subset
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control asks for an inventory of information and other assets, with owners. A list of devices and data is the core of it.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 1 item
-
ID.AM Asset management · subset
ID.AM-01: Inventories of hardware managed by the organization are maintained
ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained
ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained
A list of devices, software, accounts and data is the inventory these outcomes ask for.
Read ID.AM-01, ID.AM-02, ID.AM-07 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.