ID.AM-02 reads: "Inventories of software, services, and systems managed by the organization are maintained". SBOMs help by listing components inside each release, but you also need lists of services and systems. Maintained is the key word, so evidence has to show updates over time.
What the subcategory covers
In NIST CSF 2.0 the Asset Management category sits under Identify and begins with ID.AM-01 for hardware inventories, then ID.AM-02 for software, services and systems. ID.AM-04 covers inventories of services provided by suppliers, and ID.AM-08 covers management of systems, hardware, software, services and data through their life cycles.
Three nouns appear in ID.AM-02: software, services and systems. An SBOM covers the first at component level. Service catalogs and infrastructure exports cover the other two.
What each source contributes
| Source | Contribution | Limit |
|---|---|---|
| SBOM per release | Components and versions inside software | Does not list services or infrastructure |
| Service catalog | Services with owners and tiers | May omit shadow services |
| Image registry listing | Container images that exist | Includes images not running |
| Cloud resource export | Systems actually deployed | Needs tagging to be meaningful |
| Supplier list | Services provided by suppliers (see ID.AM-04) | Needs data classification |
Link the sources through a shared identifier such as service name. A diagram of how they join is useful to hand to an assessor.
Steps to keep it maintained
- Generate an SBOM in every release build and store it with the artifact.
- Keep the service catalog in a repository so changes are reviewed.
- Export cloud resources monthly and compare with the catalog. Investigate differences.
- Mark each item with an owner and a lifecycle status such as active, deprecated or retired.
- Record retirement actions, because ID.AM-08 cares about the life cycle.
- Keep dated exports so you can show change over time.
What good looks like
You can answer three questions quickly. What runs in production today? Who owns it? Which component versions does it contain? If an advisory lands tomorrow, the inventory should tell you which services to look at in minutes, not days.
Test it with a recent advisory about a popular library. Time how long it takes to list affected services. That exercise is better evidence of a maintained inventory than any static list.
Try it yourself
Click through the dependency inventory demo and look at how components, versions and sources are listed. This is the software layer of ID.AM-02.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard can produce SBOM and dependency scanning results and run asset discovery, which gives you machine generated inventory records to attach next to your own review notes. You can try the free scan at gold.safeguard.sh/scan. Whether a record satisfies a control is for you and your auditor to decide.
Quick check
Is an SBOM enough for ID.AM-02?
Not alone. It covers components in software, while the subcategory also names services and systems.
How current must the inventory be?
CSF does not set a number. Maintained means you can show regular updates, so pick a cadence and keep dated records.
Sources
Last reviewed: 19 October 2026.
