TSA Pipeline Security T3.ID.AM: Table 3 Identify: Asset Management

Baseline: documented policies and procedures for assessing and maintaining configuration information, tracking changes to pipeline cyber assets and patching or upgrading operating systems and applications, making sure changes do not weaken existing controls; a comprehensive set of network and system architecture diagrams or equivalent documentation including nodes, interfaces, remote and third-party connections and information flows; and review of each asset's critical or non-critical classification at least every 12 months. Enhanced: mechanisms to keep an accurate inventory and detect unauthorized components, periodic review of network connections including remote and third-party ones, and a detailed inventory for every endpoint.