Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-ID.AM-02 NIST Cybersecurity Framework 2.0
ID - Identify
NIST Cybersecurity Framework 2.0 NIST-CSF-ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained Inventories of software, services, and systems managed by the organization are maintained. Control from NIST Cybersecurity Framework 2.0 framework, domain: ID - Identify.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 80 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-1.1 Establish and Maintain Detailed Enterprise Asset Inventory CIS-1.2 Address Unauthorized Assets CIS-1.3 Utilize an Active Discovery Tool CIS-1.5 Use a Passive Asset Discovery Tool CIS-16.4 Establish and Manage an Inventory of Third-Party Software Components CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components CIS-2.1 Establish and Maintain a Software Inventory CIS-2.2 Ensure Authorized Software is Currently Supported CIS-2.3 Address Unauthorized Software CIS-2.4 Utilize Automated Software Inventory Tools CIS-5.5 Establish and Maintain an Inventory of Service Accounts CIS-6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients CM-10 Software Usage Restrictions CM-12 Information Location (CM-12) CM-7(5) Authorized Software Allow-by-Exception CM-8 System Component Inventory CM-8(1) Updates During Installation and Removal SA-4(9) Acquisition Process | Functions, Ports, Protocols, and Services in Use (SA-4(9)) SC-18 Mobile Code CM-10 Software Usage Restrictions CM-12 Information Location (CM-12) CM-7(5) Authorized Software Allow-by-Exception CM-8 System Component Inventory CM-8(1) Updates During Installation and Removal SA-4(9) Acquisition Process | Functions, Ports, Protocols, and Services in Use (SA-4(9)) SC-18 Mobile Code 1.2.5 1.2.5 Allowed services, protocols and ports justified 12.3.3 12.3.3 Cryptographic cipher suite and protocol inventory reviewed annually 12.5.1 12.5.1 Inventory of in-scope system components 4.2.1.1 4.2.1.1 Inventory of trusted transmission keys and certificates 5.2.3 5.2.3 Periodic evaluation of components not at risk from malware 6.3.2 6.3.2 Inventory of bespoke software and components ISM-1493 Maintaining software registers ISM-1643 Versions and patch histories in software registers ISM-1966 Register of systems AM-2 Use only approved services ASBv3-AM-1 Track asset inventory and their risks DS-2 Ensure software supply chain security A.4.2 Resource documentation A.4.4 Tooling resources A.4.5 System and computing resources 6.5 Asset management 6.5.1 Responsibility for assets 03.04.08 Authorized Software - Allow by Exception 03.04.10 System Component Inventory 3.4.1e Authoritative Source for Software and Firmware 3.4.3e Automated Inventory of System Components SOC2-CC6.1 CC6.1 Logical access security over protected information assets SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure E8-APP-ML1 Application Control (ML1) ANSSI-HYG-35 Anticipate the End of Maintenance of Software and Systems CPS230-P25 Information and Technology Capability and Asset Health SEC11-BP05 Centralize services for packages and dependencies AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment AESCSF-ACM-1 Asset inventory 5.9 Inventory of information and other associated assets 5.9 Inventory of information and other associated assets Art.21.2.i Human resources security, access control policies and asset management ID.AM-2 ID.AM-2: Software platforms and applications within the organization are inventoried ID.AM-2 ID.AM-2: Software platforms and applications within the organization are inventoried ID.AM-02 ID.AM-02 Current, automatically updated software, service and system inventories available to responders CE-SU.1 Software Licensed and Supported 8(d) Sec. 8(d) Inventory major information systems and provide the inventory to the registry Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in ID - Identify You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-ID.AM-02 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 80 it maps to, and the evidence behind each claim, over MCP and REST.