Requirement
In addition to the controls in ECC subdomain 2-1, cybersecurity requirements for asset management in OT/ICS environment must include, at a minimum, the following:
Sub-Controls
2-1-1-1
Requirement: OT/ICS assets inventory must be developed in electronic format for all OT/ICS assets, and reviewed periodically.
2-1-1-2
Requirement: Automated solution to collect asset inventory information must be utilized.
2-1-1-3
Requirement: OT/ICS asset inventory must be stored securely.
2-1-1-4
Requirement: Asset owners for all OT/ICS assets must be identified and involved throughout the relevant asset inventory management lifecycle.
2-1-1-5
Requirement: Criticality rating for all assets must be assigned, documented, and approved by asset owners.
References
- ECC – 2:2024 equivalent: 2-1
