CIF-2 - Asset Inventory
Automated inventory of cloud resources: owners, tagging, orphaned resource detection and infrastructure as code.
Control Definition
An automated, up-to-date inventory of all resources deployed in the cloud must be maintained, with an owner assigned to each asset and continuous reconciliation between what is recorded and what is actually deployed. Resources must be tagged with the minimum attributes needed to identify and protect them properly, automatically verifying compliance and correcting deviations. Orphaned resources must be detected and removed, infrastructure as code must be used as the inventory's source of truth, and the costs associated with each resource must be managed.
Requirements
Requirement 1
We keep the inventory of information-related assets up to date through periodic reviews.
Requirement 2
We maintain an automated, complete inventory of all resources deployed in cloud environments.
Requirement 3
We formally identify and record the owner of each asset in the inventory as a mandatory attribute.
Requirement 4
We define and enforce a mandatory tagging policy for all cloud resources.
Requirement 5
We establish Infrastructure as Code (IaC) as the inventory's source of truth.
Requirement 6
We record as minimum tagging attributes: environment, owner, cost center, application, data classification and criticality.
Requirement 7
We automatically enforce and verify tagging policies through the Cloud Service Provider's (CSP) native policies.
Requirement 8
We automatically detect orphaned cloud resources that represent unnecessary attack surface and avoidable costs.
Requirement 9
We remove unclaimed orphaned resources within the defined time frame.
Requirement 10
We manage cloud costs by tag with defined budget alerts.
Requirement 11
We validate continuous inventory reconciliation between the actual and recorded state.
Requirement 12
We notify owners of resources without complete tagging and require them to fix it within a maximum time defined by the organization.
Requirement 13
We treat any deviation between the actual state and the IaC as an anomaly.