WHAT IS APPLICATION INVENTORY COMPLIANCE AND WHY IS IT IMPORTANT?
About This Control
Summary: Application Inventory Compliance is the process of ensuring that an organization's IT applications are tracked in a centralized database, typically the Configuration Management Database (CMDB).
Purpose: This ensures that all applications are recorded in an inventory, and that necessary information, as documented in the organization’s cybersecurity policy, is entered into the inventory and validated for individual applications.
Implementation Guidance: Application Inventory Compliance involves the creation and maintenance of an application inventory, providing a source of truth for applications used by the organization. It also checks that fields required by the organization’s cybersecurity policy (e.g., application owner, owning department, business criticality, etc.) are being filled in.
Why It Matters:
Application Inventory Compliance is the foundation for other application-related controls, such as checking for unapproved applications, and applications that have exceeded their end-of-life date and are no longer supported.
Similarly, the fields required by the organization’s security policy, such as application owner, are required so there is a point of contact. Other content in the application inventory, such as environment (production, QA, development) and business criticality are needed to organize and prioritize tasks for managing applications.
Risks Addressed:
Without an accurate inventory of applications, unknown and unapproved applications might be executing in the environment or being accessed on the internet.
It is likely that unknown applications are not being monitored, patched, licensed, etc. in a way that is consistent with the organization’s cybersecurity policy.
Applications that are not compliant with cybersecurity policy are likely to be vulnerable and to expose the organization to cyber-attacks.
CONTROLS THIS DASHBOARD REPORTS ON
Frameworks:
NIST CSF v2.0: Category ID.AM Asset Management, Subcategory ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained
PCI-DSS v4.0.1: Requirement 12.5.2 PCI DSS scope is documented and confirmed by the entity at least once every 12 months and upon significant change to the in-scope environment. At a minimum, the scoping validation includes... applications that process CHD [cardholder data]
CIS CSC v8.1: Control 2 Inventory and Control of Software Assets, and Safeguard 2.1 Establish and Maintain a Software Inventory
DORA: Regulatory Technical Standard (RTS) Simplified ICT Risk Management Framework, Article 4, ICT asset management policy
PRIMARY KEY PERFORMANCE INDICATOR (KPI)
The dashboard reports on this Primary KPI:
Numerator What is measured (numerator): Applications that are inventoried in the source of truth, typically the CMDB, with all required fields filled in.
Denominator Baseline (denominator): All Applications present in the organization’s environment.
The system of record used for the numerator is typically the configuration management database (CMDB). It can also be multiple CMDBs if the organization uses more than one. The “required fields” for assets can be configured and can be based on the organization’s cybersecurity policy.
The denominator will include, in addition to assets in the CMDB, all assets discovered from tools such as vulnerability scanners, infrastructure management solutions, endpoint protection and response, and others.
COLUMNS DISPLAYED ON THE DETAIL DASHBOARD
Compliance Status: Compliance Status CMDB, Compliance Status Rules, Compliance Status
Leading: Name, Category Names, Category, Application DataBee Id, Discovered On, Discovered On Aggregate
Application Attributes: Business Department, Criticality, Description, ORG, Owned By, Status, URL, Vendor Name, Version, Last Discovered Date
Compliance Rules: Rule Name, Rule Type, Rule Value, Rule Compliance
Org Hierarchy: Owner DataBee Id, Owner Email Address, Owner Employee UID, Owner Full Name, Owner Job Title, Owner Name, Manager DataBee Id, Manager Email Address, Manager Full Name, Level 2, Level 3, Level 4, Level 5, and Level 6
DATA SOURCES BY THIS DASHBOARD
The data sources referred will be
cdp.applications
ocsf.software_info
Note:
ocsf.Application_lifecycle will not be referred.