NIS2, DORA and ISO 27001 all start with an asset inventory: what auditors actually ask for

Ask a GRC lead which control causes the most friction at audit time and asset management is usually near the top of the list. Not because it is conceptually hard, but because almost every other control depends on it. You cannot show that endpoints are patched, encrypted and monitored without first showing which endpoints exist.

This post summarizes what the major frameworks ask for in this area and what kind of evidence tends to hold up. It is general guidance, not legal advice. Always check the text that applies to your organization and your sector.

What the frameworks say

ISO/IEC 27001:2022, Annex A 5.9

Control 5.9, Inventory of information and other associated assets, requires an inventory of information and other associated assets, including owners, to be developed and maintained. Related controls build on it: 5.10 (acceptable use), 5.11 (return of assets), 7.14 (secure disposal or re-use of equipment) and 8.1 (user endpoint devices).

The emphasis on maintained and owners matters. A one-off export without ownership is a common nonconformity.

NIS2, Article 21(2)

The NIS2 Directive (EU) 2022/2555 requires essential and important entities to take appropriate cybersecurity risk-management measures. Article 21(2) lists the minimum set, and point (i) explicitly covers human resources security, access control policies and asset management. For certain categories of entities (including cloud, data-center, managed service and managed security service providers), Implementing Regulation (EU) 2024/2690 adds more detailed requirements, including maintaining an asset inventory. National transpositions vary, so check the rules of each member state you operate in.

DORA, Article 8

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies to financial entities. Article 8, Identification, requires them to identify, classify and document ICT-supported business functions and the information and ICT assets that support them, to identify all information and ICT assets (including those at remote sites, network resources and hardware) and to map those considered critical, along with their configuration and interdependencies. Inventories must be maintained and updated periodically and whenever a major change occurs.

CIS Critical Security Controls v8, Controls 1 and 5

Control 1, Inventory and Control of Enterprise Assets, is the first control for a reason. Its safeguards include establishing a detailed asset inventory (1.1), addressing unauthorized assets (1.2), using an active discovery tool (1.3), using DHCP logging to update the inventory (1.4) and using a passive discovery tool (1.5).

Control 5, Account Management, extends the same idea to identities: an inventory of accounts (5.1), disabling dormant accounts (5.3) and restricting administrator privileges (5.4).

NIST Cybersecurity Framework 2.0, ID.AM

The Asset Management category in the Identify function covers inventories of hardware (ID.AM-01) and of software, services and systems (ID.AM-02), prioritization of assets by classification and criticality (ID.AM-05), and management of assets throughout their life cycle (ID.AM-08).

The requirements side by side

Framework	Reference	Inventory	Owners	Classification / criticality	Life cycle & disposal	Discovery of unknown assets
ISO/IEC 27001:2022	A.5.9, 5.11, 7.14	Required	Required	Via related controls	Required	Implied
NIS2	Art. 21(2)(i)	Required	Expected	Expected	Expected	Implied
DORA	Art. 8	Required	Expected	Critical assets mapped	Updated on change	Including remote sites
CIS Controls v8	1.1–1.5, 5.1–5.4	Required	Required	—	Address unauthorized assets	Active, passive, DHCP
NIST CSF 2.0	ID.AM-01/02/05/08	Required	—	Required	Required	Implied

The common thread is clear: an inventory that is complete, owned, classified, kept current and managed through retirement.

What auditors look for in practice

Frameworks describe outcomes; auditors look for evidence. In our experience the questions cluster around five themes.

1. Completeness

How do you know nothing is missing? An inventory sourced from a single system (the directory, say) is easy to challenge. Evidence of independent discovery (network scans, multiple correlated sources) is much stronger.

2. Currency

When was this last updated? First-seen and last-seen dates per asset, and a record of when each source last ran, answer this directly. A spreadsheet dated three months ago does not.

3. Ownership

Who is accountable for this server? Owners should be recorded on the asset, not in someone's memory. Owners derived from real usage and linked to the directory are easier to defend than free-text fields.

4. Change control

How do new assets enter the register, and who approves changes? A defined process (automatic for trusted sources, reviewed for others) demonstrates that the inventory is managed rather than merely collected.

5. Retirement

This asset was in last year's register. Where did it go? Auditors increasingly ask for evidence that assets were actually decommissioned, not simply deleted. A trail showing when, why and on what evidence an asset was retired closes the question.

Practical steps

1. Correlate before you report. Combine directory, endpoint, cloud, MDM and network discovery into one record per asset.
2. Record the source of every fact. "Reported by EDR on 3 August" is evidence; "OS: Windows" is not.
3. Add classification fields for criticality, data classification and compliance scope, and fill them by rule where possible.
4. Put changes through review where the framework expects change control.
5. Retire with evidence. Keep a log of decommissioning decisions.
6. Produce the same report every quarter. A consistent, scheduled export from live data is more convincing than a fresh spreadsheet each time.

Where Lumen Edge fits

Lumen Edge collects and correlates the data these controls depend on today: a correlated register with first/last-seen dates and source attribution, ownership enrichment, custom fields for criticality and scope, per-source approval policies, evidence-based decommissioning and scheduled Excel reports. Evidence packs mapped directly to ISO 27001, NIS2, DORA and CIS Controls are on our roadmap.

If an asset-management finding is on your remediation list, book a demo and we can walk through what your evidence could look like.