The entity adopts internal rules governing the whole lifecycle of its information and communication systems and their components, spelling out the conditions, methods and procedures for acquiring, deploying, maintaining, relocating or removing, decommissioning and destroying them. The asset description required by Article 5 must hold what incident resolution, risk assessment, vulnerability management and change management need: a unique identifier such as an inventory or serial number, key characteristics, the services, processes and activities the asset supports, its location, year of manufacture and deployment date where applicable, version where applicable, where its technical, operational and user documentation sits, and the person responsible for it.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.