Assets are managed from purchase to disposal, used effectively and efficiently, and kept on record and physically protected until they are properly retired: all assets are bought on approved requests under the enterprise procurement policy; they are sourced, received, checked, tested and recorded under control, with physical labels applied where needed; payments are approved and made on the agreed contract terms; assets are deployed through the standard implementation life cycle, change management and acceptance testing included; they are issued to users who accept the responsibilities and sign off; assets no longer needed because of a role change, redundancy or service retirement are reallocated; retirement is planned, authorised and carried out, with records kept as business and regulatory needs require; and disposal is secure, with stored data permanently erased and environmental harm considered, and responsible once assets no longer serve a purpose.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.