This requirement exists to compare internal license records with vendor information and resolve discrepancies and to support accurate, accountable, and secure asset management.
Establish a documented process for compare internal license records with vendor information and resolve discrepancies. Define accountable roles, required inputs and outputs, approval or validation points, evidence requirements, review frequency, and escalation criteria. Integrate the process with the authoritative asset inventory and related security, procurement, operations, and lifecycle processes. The organization should retain sufficient records to demonstrate that the requirement is operating as intended.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.2-3.1 – Information asset profiling |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 2) Preventing execution of unauthorised software – 2.1 Authorised/unauthorised software inventory and application whitelisting |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 2.1 ID.AM: Asset Management |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 8(1) – Identify, classify and document ICT-supported business functions, information assets and ICT assets Article 8(6) – Maintenance and periodic updating of relevant inventories |
EU
Regulation
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(i) – Human resources security, access control policies and asset management |
EU
Directive
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.3 – Build, Acquire and Implement (BAI) > BAI09 – Managed Assets > BAI09.01 – Identify and record current assets. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.AM – Asset Management | ID.AM-01 – Inventories of hardware managed by the organization are maintained ID.AM – Asset Management | ID.AM-02 – Inventories of software, services, and systems managed by the organization are maintained |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.5 – CONFIGURATION MANAGEMENT; CM-10 – SOFTWARE USAGE RESTRICTIONS, CM-8 – SYSTEM COMPONENT INVENTORY |
NIST
Control Catalog
|
vRev. 5 | View → |
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 02 – Inventory and Control of Software Assets: 2.1 – Establish and Maintain a Software Inventory |
CIS
Best Practice
|
vv8 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC2.1 – Information and Communication – COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control. CC9.2 – Risk Mitigation – The entity assesses and manages risks associated with vendors and business partners. |
AICPA
Audit Framework
|
vLatest | View → |