Summary
Building a CMDB, if you do not have one already, will be the focal point for meeting the control objectives in this family. The CMDB shall record all identifying information about the resource; this includes the IP and MAC address of the system, make, model, and who is responsible for it, among others. The information in the CMDB should also include the importance of the resource and whether it is an on-premises, off-premises, or third-party-hosted SaaS offering.
You should also include the software and firmware present on these systems. Both should be updated regularly to ensure the system is free of bugs and vulnerabilities. You should also include rogue devices in your CMDB. Not only will this highlight the need for proper identification of the rogue asset but it will also help you understand what is connected to the network. The CMDB should also hold network flow diagrams, which will come in handy during an incident. The network diagrams should depict what is in the...