What types of assets should be included in an organization's asset inventory according to NIST CSF?
- A.Meeting minutes, budget lines, headcount requests, travel approvals, expense reports, purchase orders, and receipts from external vendors
- B.Training records, certification dates, quiz scores, onboarding checklists, badge assignments, parking permits, and visitor logs from external guests
- C.Physical devices, software platforms, applications, external information systems, data, network resources, and connections to external systems
- D.Incident tickets, escalation notes, resolution times, satisfaction scores, shift schedules, on-call rosters, and callbacks from external customers
Why C is correct
A comprehensive asset inventory includes all hardware, software, data, and connections that support the organization, including external systems and third-party services, to ensure complete visibility.
Know someone studying for NIST CSF? Send them this one.