Consistency between 1.4 and 2.1 or added context
Opened this issue · 2 comments
Controls
Control 1.4: Maintain Detailed Asset Inventory
https://controls-assessment-specification.readthedocs.io/en/latest/control-1/control-1.4.html
Control 2.1: Maintain Inventory of Authorized Software
https://controls-assessment-specification.readthedocs.io/en/latest/control-2/control-2.1.html
Comment
Is there a documented logic as to why these controls while conceptually similar take different approaches towards defining Measures + Metrics?
Hey PL!
The logic here was that 1.4 is more focused on tooling and ensuring the tooling is working/configured appropriately across relevant assets to help update the inventory. 2.1 is more generic since we do not know if enterprises will be using tooling or not, and we do not make a recommendation either way. Does this help? If not, we can discuss further.
v/r
Ginger
PL,
Was this for Controls v7.1 or CAS 1.0? If so, closing.