Frameworks / NIST Cybersecurity Framework 2.0 / NIST-CSF-ID.AM-07 What else in your programme already covers this This control maps to 71 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
12.5.1 12.5.1 Inventory of in-scope system components 9.4.2 9.4.2 Classification of media by data sensitivity 9.4.5 9.4.5 Inventory logs of electronic media 9.4.5.1 9.4.5.1 Annual inventories of electronic media 3.2.1 3.2.1 Data retention and disposal minimise stored account data 6.3.2 6.3.2 Inventory of bespoke software and components CIS-3.1 Establish and Maintain a Data Management Process CIS-3.12 Segment Data Processing and Storage Based on Sensitivity CIS-3.13 Deploy a Data Loss Prevention Solution CIS-3.2 Establish and Maintain a Data Inventory CIS-3.7 Establish and Maintain a Data Classification Scheme 6.5 Asset management 6.5.1 Responsibility for assets 6.5.2 Information classification 7.2.8 Records related to processing PII 7.5.3 Records of transfer of PII CM-12 Information Location (CM-12) CM-12(1) Information Location | Automated Tools to Support Information Location (CM-12(1)) MP-5 Media Transport SI-12 Information Management and Retention CM-12 Information Location (CM-12) CM-12(1) Information Location | Automated Tools to Support Information Location (CM-12(1)) MP-5 Media Transport SI-12 Information Management and Retention A.4.2 Resource documentation A.4.3 Data resources A.4.5 System and computing resources A.7.5 Data provenance SOC2-C1.1 C1.1 Identifying and maintaining confidential information SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13) SOC2-PI1.1 PI1.1 Quality information about processing objectives, data definitions and specifications SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs ISM-0393 Classifying databases and their contents ISM-1243 Maintaining and verifying a database register ISM-1451 Data types and ownership in contracts 5.12 Classification of information 5.9 Inventory of information and other associated assets 7.10 Storage media APPI-A22 Accuracy and Deletion of Personal Data APPI-A29 Records When Providing Personal Data to a Third Party ADMF-3.1 Identify and understand organisational data ADMF-3.2 Maintain a data inventory SEC07-BP01 Understand your data classification scheme SEC07-BP03 Automate identification and classification AUCDR-IS-3 Securely manage information assets over their lifecycle AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment CDMC-KC2 Ownership Field CDMC-KC5 Cataloguing ANSSI-HYG-04 Identify the Most Sensitive Information and Servers and Maintain a Network Diagram CPS234-20 Information Asset Classification ASBv3-DP-1 Discover, classify, and label sensitive data C5-OPS-11 Logging and Monitoring - Metadata Management Concept DCAM-4.4 Critical Data Element Identification 5.9 Inventory of information and other associated assets Art.21.2.i Human resources security, access control policies and asset management 3.14.5e Review Persistent Storage and Remove CUI No Longer Needed ID.AM-07 ID.AM-07 Data inventories show what data an incident may have involved Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in ID - Identify NIST-CSF-ID.AM-01 Inventories of hardware managed by the organization are maintained NIST-CSF-ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained NIST-CSF-ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained NIST-CSF-ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles NIST-CSF-ID.IM-01 Improvements are identified from evaluations NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done? NIST Cybersecurity Framework 2.0 NIST-CSF-ID.AM-07 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 71 it maps to, and the evidence behind each claim, over MCP and REST.