What it means
An asset matters because someone depends on it. Security inventories often begin with computers, but valuable assets also include data, applications, business services, equipment, and supporting relationships. A useful description connects the item to the work it enables and the people who would be affected by its loss.
Start with the service rather than a shopping list of hardware. A customer appointment process may depend on a database, staff accounts, a hosting provider, and an internet connection. Naming those dependencies helps you select protections and recovery priorities. Each asset also needs an owner who can explain its purpose and make decisions about its use.
The idea at a glance / Foundations
An asset has a purpose and an accountable owner.
Hold a business service beside its data, application and supplier dependency.
This synthetic map selects four connected records from a delivery operation. Nora owns daily 06:00 dispatch S153. Route/address data D153 supports it; Maya owns app A153, which consumes that data. Harbor’s hosting service V153 supports A153, with Sam accountable for the supplier relationship. The stated relationships and current records are exercise assumptions.
READ THE PICTURE
Purpose, ownership and dependencies
S153 needs D153 through A153, supported by Harbor V153. Nora, Maya and Sam have different responsibilities; the map is still incomplete.
Keep in mindThese selected records are not a complete inventory or proof of protection, availability or recovery. People, hardware, identity, network paths and copies may also matter. Assigning an owner neither transfers an asset to that person nor tests that every dependency works.
Read the complete example
- Purpose, ownership and dependencies. S153 needs D153 through A153, supported by Harbor V153. Nora, Maya and Sam have different responsibilities; the map is still incomplete. Nora is accountable for 06:00 dispatch S153 and its route/address data D153. Incorrect addresses can send deliveries to the wrong place; disclosure exposes selected customer information. Maya owns application A153, which uses D153 to support S153. Sam owns the supplier relationship for Harbor hosting V153, on which A153 depends; Sam does not own Harbor itself. These four records are a selected inventory map, not chronological steps. Hardware, people, account permissions, network access, data copies and recovery dependencies still need reconciliation. Naming owners and consequences helps direct that work, but no outage, protection check or restore has been performed.
These selected records are not a complete inventory or proof of protection, availability or recovery. People, hardware, identity, network paths and copies may also matter. Assigning an owner neither transfers an asset to that person nor tests that every dependency works.
Diagram references: NIST CSF 2.0: asset inventories, purpose and responsibility
AN ILLUSTRATIVE SCENARIO
Map the telemetry service, not just devices
Priya owns 06:00 orbital pass scheduling S153 and ephemeris data D153. Vera owns A153, which uses D153 to support that service. CloudHost V153 supports A153, and Sloane owns the supplier relationship. The records connect purpose, consequences and responsibility. Identity, network, hardware, copies and recovery dependencies still need reconciliation; an owner name is not a successful availability or restore test.
Put it to work
- Choose one business service and list the information, technology, people, and outside services it depends on to function.
- Record each asset’s owner, purpose, location, dependencies, and the consequences of disclosure, incorrect change, or unavailability.
- Keep the record current as assets are created, moved, shared, and retired; use its criticality to guide protection and recovery work.
How to check your work
Select an asset from the inventory and ask its owner to trace a real workflow through it. Confirm that its current location, users, dependencies, and recovery expectations match the record.
Connect the ideas
- CIA triad
A shorthand for naming whether a loss is disclosure, unauthorized change, or downtime.
- Data classification
Labeling records by the harm of disclosure, alteration, or loss so protection and retention can follow.
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
- Backup
A copy of data kept so integrity and availability can be restored after loss, preferably beyond the production identity’s reach.