ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 6.1: Inventory every technology asset, classify it by criticality and data sensitivity, and define what makes a system critical

What does 6.1 require?

A process records every asset acquired, modified, moved or decommissioned and the list is regularly reviewed so the institution can track each asset and the party responsible. Tracked assets include hardware, software including licences, patches and libraries, datasets including logs, online assets such as IP addresses, domains and cloud assets, cryptographic assets such as keys and tokens, and assets rented, leased, subscribed or managed by third parties. A security classification framework applies controls according to asset criticality and data sensitivity, with alternative arrangements where replacement is a risk. The institution defines criteria and a methodology for critical systems, considering the business function supported, the risk if the system fails or is compromised (value of data, threats, vulnerabilities, impact and likelihood) and the extent other systems depend on it, and applies strict confidentiality, integrity and availability requirements and a comprehensive security approach to critical systems.