ID.AM-01 — Hardware inventory

Inventories of hardware managed by the organization are maintained.

Also written as ID-AM-01, ID.AM-1, CSF 2.0 ID.AM-01, NIST CSF ID.AM.

Written by Jett N. · Last reviewed 22 July 2026

What NIST CSF ID.AM-01 means

ID.AM-01 is one of 21 subcategories in the Identify (ID) function, under the Asset Management category (ID.AM). The Core states: “Inventories of hardware managed by the organization are maintained.” Identify outcomes are prerequisites rather than protections — if the underlying inventory or risk analysis is incomplete, every downstream Protect and Detect outcome inherits that gap.

Evidence that supports ID.AM-01

To demonstrate this outcome in an assessment or audit, gather artefacts such as:

How to implement ID.AM-01

1. Discover automatically; do not surveyAsking teams what hardware they have produces an inventory of what people remember. Network discovery, endpoint agent reporting and cloud provider APIs produce one of what exists. The delta between the two is itself a useful finding.
2. Define what counts as hardware in your contextCloud instances, containers running on managed nodes, mobile devices, contractor laptops and network appliances are all in scope for most organisations. A physical-server-only inventory is a 2005 answer to a 2026 outcome.
3. Record an owner for every assetAn inventory without ownership cannot drive any downstream decision — who patches it, who approves its access, who decommissions it. Ownership is what makes the inventory operational rather than descriptive.
4. Reconcile sources on a scheduleCompare discovery output against procurement records, MDM enrolment and the endpoint protection console. Each system knows about assets the others do not, and the reconciliation is where unmanaged devices surface.
5. Close the loop with joiners and leaversDevice assignment and return should be part of the HR lifecycle. Unreturned hardware from leavers is both a common finding and a real risk, and it is invisible without this link.

Common assessment findings for ID.AM-01

What actually gets raised against ID.AM-01, in rough order of how often it comes up:

• Inventory maintained manually in a spreadsheet, last updated months ago and materially out of date.
• Cloud and container assets excluded because the inventory was designed around physical hardware.
• No asset ownership recorded, so the inventory cannot drive patching or access decisions.
• Discovery coverage smaller than the actual network, with unmanaged devices never surfacing.

Assessing ID.AM-01 in a profile

ID.AM-01 is foundational — its completeness caps how well almost every Protect and Detect outcome can score, because you cannot protect or monitor what is not enumerated. If you assess only a handful of subcategories, assess this one first.

ISO 27001 mapping

ID.AM-01 corresponds to the following ISO 27001:2022 Annex A control(s): A.5.9, A.7.9, A.8.1. Evidence collected for one framework typically supports the other.

Other Asset Management subcategories

All 21 Identify subcategories →