Comprehensive asset inventory with classification and ownership
Primary statement
A current inventory of ALL asset types — hardware, software, network devices, data assets, services, third-party dependencies, cryptographic assets, and intangible IT assets — shall be maintained continuously through change management integration. Each asset record includes: owner, location, criticality classification, sensitivity, regulatory scope (PII, PCI, financial), and applicable controls tier. The inventory is the foundation for every other security and privacy control; it is the single source of truth queried by IR, vulnerability management, access reviews, and audit.
Audit-fatigue payoff
A single inventory artefact — refreshed via change-management integration, with the SEBI CSCRF asset categories (hardware/software/data/services/third-party) and the RBI ITGRCA classification fields (owner, criticality, regulatory scope) — answers asset-inventory questions across all 13 contributing frameworks. Without it, the auditor asks 13 different questions and you demonstrate 13 different evidence trails. With it, the auditor asks one question and you point to one CMDB.
Strictness matrix
Scope
Comprehensive inventory of ALL assets — hardware, software, data, services, third-party dependencies — shall be maintained. SEBI CSCRF explicitly enumerates the asset categories, closing the common gap where data and third-party dependencies are excluded from "asset" definitions narrowed to hardware/software.
Ceiling source: sebi_cscrf:CSCRF.ID.1
Rationale: SEBI CSCRF ID.1 uniquely enumerates five asset categories explicitly including third-party dependencies. ISO 27001 A.5.9 uses "information and other associated assets" which is broad but less prescriptive. The enumeration is the audit-defensible scope.
Threshold
Every asset records: owner, location, criticality (Most-Critical / Critical / Important), sensitivity (per classification scheme), regulatory scope (PII, PCI, RBI critical, financial customer data), and differential-controls mapping. The threshold for "inventory inclusion" is any asset that processes, stores, or transmits organisational information.
Ceiling source: rbi_itgrca:ITGRCA.RM.2
Rationale: RBI ITGRCA RM.2 specifies the inventory record fields explicitly. Other frameworks require "an inventory" but do not enumerate the fields required per asset. The field-enumeration is the strictness ceiling because it determines whether an inventory is actually useful for downstream controls.
Method
Inventory is maintained through automated discovery + change management integration, not manual periodic snapshots. New assets are reflected in the inventory within the same change-management cycle as their deployment. Reconciliation between authoritative inventory and discovery scans is performed at minimum quarterly with documented discrepancy investigation.
Ceiling source: sebi_cscrf:CSCRF.ID.1
Rationale: SEBI CSCRF ID.1 specifies "continuously updated through change management integration" — the most prescriptive method. ISO 27001 requires an inventory but does not mandate change-management integration; satisfying SEBI also satisfies ISO.
Frequency
Continuous update through change management. Reconciliation between authoritative inventory and discovery scan output at minimum quarterly with discrepancy investigation. Periodic full audit (annual) of the inventory completeness and accuracy.
Ceiling source: sebi_cscrf:CSCRF.ID.1
Rationale: Continuous update is the strictest cadence. Quarterly reconciliation is the strictest verification cadence. Annual completeness audit is the supervisory expectation. Together these form the audit-defensible frequency model.
Evidence
Required evidence: (1) data asset register with classification, owner, hosting system, regulatory scope; (2) differential-controls mapping by classification tier showing what controls apply to Critical vs Most-Critical; (3) change-management integration evidence (sample change tickets traced to inventory updates); (4) reconciliation records (discovery scan output vs authoritative inventory, with discrepancy investigation); (5) annual completeness audit results.
Ceiling source: rbi_itgrca:ITGRCA.RM.2
Rationale: RBI ITGRCA RM.2 enumerates the most-specific evidence requirements. The differential-controls-mapping element is uniquely strict — it requires demonstrating that the inventory is operationally used to drive other controls, not just maintained for its own sake.
Auditor test pattern
Step 1: Request the asset inventory and verify it covers all five SEBI CSCRF categories (hardware, software, data, services, third-party). Step 2: Sample 3 recent change tickets and trace each to a corresponding inventory update within the same change cycle. Step 3: Sample 3 assets from the inventory and verify they exist as recorded (system reachable; ownership confirmed; criticality matches operational reality). Step 4: Conversely, sample 3 systems from a discovery scan and verify each appears in the authoritative inventory (no shadow IT). Step 5: Inspect the differential-controls mapping; sample 2 Most-Critical systems and verify the enhanced controls are actually applied.
Common findings
Common 2024–26 findings: (1) Inventory exists for hardware/software but excludes data assets, SaaS services, and third-party dependencies; (2) Inventory refreshed annually via manual survey, not continuously through change management; (3) Engineering/telemetry/support tooling not in inventory (shadow IT); (4) Vendor flows incomplete — no record of which third-party processors actually receive what; (5) Inventory fields populated but criticality classification not used to drive differential controls.