Baseline control principles for it asset management (required of every AI (minimum for a low inherent risk)). An inventory of IT assets (hardware, software, data and systems, hosted internally and externally) is kept, with accountability for it assigned; assets are prioritised for protection by data classification and business value; the inventory, including the critical assets, is reviewed at least annually for new, relocated, repurposed and retired assets; a documented asset life-cycle process checks that assets to be acquired carry the right safeguards. In 2.0 controls also detect shadow IT, applications acquired without governance and approval (level not stated in the held sources).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.