CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 CPG-2.A: Asset Inventory

What else in your programme already covers this

This control maps to 48 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27043:2015 · 3 controls

ISO27043-06 Asset inventory and ownership
ISO27043-08 Information classification and labeling
ISO27043-10 Media management and disposal

ISO/SAE 21434 · 3 controls

ISO21434-07 Acceptable use of assets
ISO21434-08 Information classification and labeling
ISO21434-09 Asset handling procedures

NIST SP 800-61 Rev. 3 · 3 controls

NISTSP61-1 Incident Response Policy, Plan, and Procedures
NISTSP61-3 Preparation: Communications, Toolkits, Training, Exercises, Threat Intelligence
NISTSP61-4 Detection and Analysis: Sources, Triage, Categorisation, Prioritisation

MITRE ATT&CK · 2 controls

MITRE-ATTACK-Tactics-14-Enterprise-Kill-Chain-Reconnaissance-Initial-Access-Discovery-Lateral-Movement-Impact MITRE ATT&CK 14 Enterprise Tactics + Reconnaissance + Initial Access + Discovery + Lateral Movement + Impact
MITRE-ATTACK-Techniques-Sub-Techniques-200-600-T1078-T1059-T1566-T1190-T1486-Procedures-Adversary-Behaviour MITRE ATT&CK Techniques + 200+ + Sub-Techniques + 600+ + T1078 + T1059 + T1566 + T1190 + T1486 + Procedures

MITRE D3FEND · 2 controls

MITRE-D3FEND-Harden-Tactic-Application-Credential-Message-Platform-Hardening-MFA-Encryption-Secure-Boot MITRE D3FEND Harden Tactic + Application + Credential + Message + Platform + MFA + Encryption + Secure Boot
MITRE-D3FEND-Model-Tactic-System-Inventory-Network-Mapping-Identity-Discovery-Asset-Identification MITRE D3FEND Model Tactic + System Inventory + Network Mapping + Identity Discovery + Asset Identification

NIST SP 800-88 · 2 controls

NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework
NISTSP88-5 Media Inventory, Tracking, Chain of Custody, and Sanitization Records

NIST SP 800-92 · 2 controls

NISTSP92-2 Log Generation: OS, Application, Security Tools, Network, Cloud, Required Event Content
NISTSP92-7 Privacy in Logs, Sensitive Content Handling, Cloud and SaaS Log Considerations

OWASP SAMM · 2 controls

OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture
OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management

SIG (Shared Assessments) · 2 controls

SHAREASSESS-1 Information Governance and Risk
SHAREASSESS-2 Access Control, Identity, Authentication

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

IACS-UR-E26-Identify-AssetInventory-CBS-NetworkArchitecture-Risk IACS UR E26 Identify Goal - Asset Inventory of Computer Based Systems + Network Architecture Documentation + Risk-Assessable Scope

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 1 control

ISO-19650-1-5 Delivery team and task team concepts

ISO/IEC 27010:2015 · 1 control

27010-8.1 Membership Onboarding

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-123 · 1 control

NISTSP123-8 Governance, Policies, and ISMS Integration

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

MD124-POL-01 Mobile Device Security Policy

NIST SP 800-137 · 1 control

NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment

NIST SP 800-63-4 · 1 control

NISTSP63R4-7 Privacy, Records Retention, and User-Controlled Wallets

NSA Guidance for Transition to Quantum-Resistant Cryptography · 1 control

QRCM-1.1 Cryptographic Asset Inventory

OWASP MASVS · 1 control

OWASPMASVS-1 MASVS-STORAGE: Storage of Sensitive Data

OpenSSF Scorecard · 1 control

OSSFSC-2 Dependency Management, Pinning, Updates, Vulnerability Tracking

PTES · 1 control

PTESPHASE-1 Pre-Engagement Interactions and Scoping

SLSA · 1 control

SUPCHAIN-1 Build Integrity - Source, Build, Provenance

Sigstore - Software Artifact Signing and Verification · 1 control

SIGSTORE-2 Transparency Log (Rekor) and Verification

TISAX - Trusted Information Security Assessment Exchange · 1 control

TISAXASS-2 ISA Catalog Implementation

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.