Asset management and inventorying your physical systems, we all know we should do it, and I am sure most try. I am not going to talk about the should have, would have or could have. Instead, I am going to focus on the risks associated with the NIST CSF control ID-AM.1.
The control simply states, “Physical devices and systems within the organization are inventoried.” At the simplest level, this control is saying that the organization inventories all physical systems that are apart of the information system. In my opinion, the control is foundational because how can you secure something if you don't know it exists. If you are not inventorying your systems, how do you know if they have adequate controls to protect the data and network. If you had a breach of data, would you know what type of data was involved, or would you even know if you had a breach? To further extend this, how can you perform a risk assessment on the system to understand and relay any risks to the overall information system?
If this control is not in place and at a minimum level repeatable, your organization is higher risk. You have to know what you have to be able to protect it.