NIST CSF 2.0 ID.AM-01: Keep a Hardware Inventory

ID.AM-01 says inventories of hardware managed by the organization are maintained. You cannot protect a laptop you forgot you issued. A current list of devices, with an owner for each, is the base for patching, access reviews and incident response.

CSF is voluntary guidance. There is no CSF certification.

What good looks like

One list covers IT, mobile and, where you have them, IoT and operational technology devices. Each entry has an owner, a location or user, an operating system or firmware version and a status. New devices appear on the list within days, not quarters.

How to implement it

1. Export from what you already have: MDM, endpoint agent, directory, purchasing records and the network switch or Wi-Fi controller.
2. Merge into one sheet or tool keyed by serial number.
3. Run network discovery on a schedule to catch devices nobody registered.
4. Assign an owner and a status (in use, spare, retired) to each row.
5. Tie it to onboarding and offboarding so devices are added at issue and removed at return.

A worked example

A fifty person company starts with the MDM export, which lists 61 laptops and phones. The identity provider shows 48 active users. The gap is thirteen devices, of which nine belong to people who left and four are spares in a drawer. The switch and Wi-Fi logs reveal two devices nobody recognized: a printer and a test board an engineer had plugged in. After a fifteen minute conversation each gets an owner or is removed. The hour of work produced a list the company trusts.

Evidence to collect

• The inventory export with date.
• A discovery scan report compared with the list.
• Offboarding records showing device return.

Common gaps

• Personal phones and test hardware sit outside the list.
• Retired devices stay in the list, hiding real gaps.
• Discovery runs once and is never repeated.

Quick check

Sources

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf