Identify 2.2 Identify 2.2.1 Asset management The data, individuals, devices, systems and facilities of an organisation are identified, catalogued and rated. Their rating should correspond to their criticality in the business processes that must be completed, and the organisation’s risk strategy. Description Task ID.AM-1 Draw up an inventory-taking process which ensures that you have a complete inventory of all your ICT assets at all times. ID.AM-2 Produce an inventory of all of the software platforms/licences and applications within your organisation. ID.AM-3 Catalogue all of your internal communication and data flows. ID.AM-4 Catalogue all external ICT systems that are relevant to your organisation. ID.AM-5 Prioritise the resources that you have inventoried (devices, applications, data, etc.) based on their criticality ID.AM-6 Define clear cybersecurity roles and responsibilities. Table 3: ID.AM tasks Standard Reference CCS CSC 1 1, 2 COBIT 5 BAI09.01, BAI09.02, BAI09.05, DSS05.02, APO02.02, APO03.03, APO03.04, PO01.02, DSS06.03 ISA 62443-3:2013 SR 7.8 ISO 27001:2013 A.6.1.1, A.8.1.1, A.8.1.2, A.8.2.1, A.11.2.6 NIST-SP-800-53 Rev. 4 AC-4, CA-3, CA-9, PL-8, CM-8, AC-20, SA-9, CP-2, RA-2, SA-14, CP-2, PS-7, PM-11 BSI 100-2 M 2.225, M 2.393, B 2.10, M 2.193 Table 4: ID.AM references Minimum ICT standard 2018 15