ISO/IEC 27001

Asset Management as the Foundation of Vulnerability Management: Unknown Assets Cannot Be Protected

The article explains that asset management forms the essential base for any effective vulnerability management program, as organizations cannot protect systems they do not know exist. It details multiple data sources including SIEM, NTA/NDR, Active Directory, CMDB, virtualization platforms, and cloud APIs that must be combined to build a complete inventory. Key record fields such as asset criticality, responsible owner, and last successful scan date are highlighted as critical for prioritization and SLA compliance. The piece examines new Russian regulations including FSTEC Order No. 117 and Federal Law No. 58-FZ that mandate accurate asset inventories to meet monthly scanning and 24-hour critical patch requirements. International frameworks such as CIS Controls v8.1, NIST CSF 2.0, and ISO/IEC 27001:2022 are compared, emphasizing lifecycle management and reaction processes for unauthorized assets. Emerging asset types including cloud resources, SaaS services, AI systems, containers, and IoT devices are discussed as expanding the attack surface faster than organizations can track.