[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fid-am":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","id-am","ID.AM-2","Asset Management",258,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Identify category asks the organisation to identify and manage the assets that let it achieve its business purpose, including hardware, software, services, data and systems, in line with their importance to objectives and risk strategy. ID.AM-2 in CSF 1.1 specifically covers inventories of software platforms and applications.\n\n**In practice.** Inventories of hardware, software, services and data flows are maintained automatically where possible and include ownership and criticality. Software inventories record versions and support status and feed vulnerability management. Assets are prioritised by business value so that protection effort matches importance. Evidence includes current inventories, data flow diagrams and criticality ratings.\n\n**Common gaps.** Inventories often omit SaaS, cloud services and shadow IT, and data assets are rarely mapped. Criticality ratings are frequently missing, so every asset is treated the same.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},263,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"unpatched-check-point-gateways-wiped-after-chained-exploit-attack","Unpatched Check Point Gateways Wiped After Chained Exploit Attack","2026-11-13T13:22:53.744+00:00",{"slug":24,"title":25,"published_at":26},"maersk-ransomware-hit-stems-from-unretired-legacy-system-inherited-in-acquisition","Maersk Ransomware Hit Stems from Unretired Legacy System Inherited in Acquisition","2026-11-12T19:20:58.818+00:00",{"slug":28,"title":29,"published_at":30},"critical-buffer-overflow-in-third-party-library-exposes-siemens-industrial-edge-systems","Critical Buffer Overflow in Third-Party Library Exposes Siemens Industrial Edge Systems","2026-11-12T18:21:30.962+00:00",{"slug":32,"title":33,"published_at":34},"acquired-it-systems-become-a-data-breach-vector-for-maersk","Acquired IT Systems Become a Data Breach Vector for Maersk","2026-11-12T09:20:20.555+00:00",{"slug":36,"title":37,"published_at":38},"browser-extensions-are-a-silent-supply-chain-threat","Browser Extensions Are a Silent Supply-Chain Threat","2026-11-11T20:20:24.025+00:00",{"slug":40,"title":41,"published_at":42},"sboms-are-essential-for-faster-vulnerability-response-and-software-transparency","SBOMs Are Essential for Faster Vulnerability Response and Software Transparency","2026-11-10T17:20:40.322+00:00",{"slug":44,"title":45,"published_at":46},"claude-code-desktop-flaw-enabled-html-based-credential-theft","Claude Code Desktop Flaw Enabled HTML-Based Credential Theft","2026-10-16T18:20:18.997+00:00",{"slug":48,"title":49,"published_at":50},"china-linked-hackers-exploit-beyondtrust-zero-day-to-seize-remote-support-servers","China-Linked Hackers Exploit BeyondTrust Zero-Day to Seize Remote Support Servers","2026-10-16T08:20:44.884+00:00",{"slug":52,"title":53,"published_at":54},"path-traversal-flaw-in-thermo-fisher-torrent-suite-exposes-sensitive-files","Path Traversal Flaw in Thermo Fisher Torrent Suite Exposes Sensitive Files","2026-10-15T18:21:22.798+00:00",{"slug":56,"title":57,"published_at":58},"end-of-life-ot-devices-enable-supermarket-refrigeration-cyberattack","End-of-Life OT Devices Enable Supermarket Refrigeration Cyberattack","2026-10-15T14:20:22.449+00:00",{"slug":60,"title":61,"published_at":62},"unpatched-collabora-code-app-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora CODE App Lets Attackers Backdoor Nextcloud Servers","2026-10-14T20:20:54.985+00:00",{"slug":64,"title":65,"published_at":66},"critical-ics-vulnerabilities-demand-urgent-patching-across-industrial-vendors","Critical ICS Vulnerabilities Demand Urgent Patching Across Industrial Vendors","2026-10-14T16:20:20.989+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",157,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",148,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",52,{"slug":84,"name":85,"problem":86,"stories":87},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",50,{"slug":89,"name":90,"problem":91,"stories":92},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",47,{"slug":94,"name":95,"problem":96,"stories":97},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",31,[99,105,111,116,120,125,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",215,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","si-2","SI-2","Flaw Remediation",169,{"family":112,"item":113,"code":114,"title":114,"together":115},"itil","overview","ITIL",154,{"family":100,"item":117,"code":118,"title":119,"together":77},"12","Control 12","Network Infrastructure Management",{"family":100,"item":121,"code":122,"title":123,"together":124},"2","Control 2","Inventory and Control of Software Assets",93,{"family":126,"item":127,"code":128,"title":129,"together":130},"gdpr","32","Article 32","Security of processing",92,{"family":100,"item":132,"code":133,"title":134,"together":135},"4","Control 4","Secure Configuration of Enterprise Assets and Software",64,{"family":137,"item":138,"code":139,"title":140,"together":141},"nist-sp","800-82","SP 800-82","SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security",63]