Insights · Field note · Infrastructure and resilience
Asset and configuration review as a security control
Every control assumes you know what exists and how it is set. Most organizations are guessing at both.
An asset and configuration review establishes what hardware, software and services exist, how they are configured, who owns them, what they handle and what is unsupported, by reconciling records against discovery and comparing running configurations against baselines. It is a security control in its own right because every other control depends on it: patching covers only known assets, segmentation protects only mapped systems, monitoring watches only enrolled devices, and compliance scope includes only what is inventoried. Unknown assets are unprotected by definition, and in our reviews (first-hand) discovery always finds some.
In detail
What the evidence shows.
Records versus reality
Purchase records, inventory spreadsheets, configuration databases and cloud consoles each describe part of the estate, usually out of date. Network and endpoint discovery finds what is actually there. Reconciliation produces three lists: unknown assets to investigate, missing assets to resolve, and the register that is finally true.
Configuration baselines
A baseline states how a class of system should be configured. Comparing running configuration against it finds drift: the port opened for a project and never closed, the service enabled by default, the setting changed during an incident. Without a baseline there is nothing to compare, which is why NIST SP 800-53 and SP 800-171 require them.
Ownership and consequence
Each asset gets an owner, a function, a criticality and a note of the data it handles. Assets handling regulated data are cross-checked against compliance scope documents, because a CUI or health data system missing from the scope is an assessment finding and a real exposure.
Maintaining the register
The review is a snapshot; the register is kept true through change control, periodic rediscovery and ownership reviews. The asset and configuration review worksheet sets out the steps; see asset and configuration review and hardware lifecycle risk.
Sources
Primary references.
- NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (configuration management, maintenance and physical protection families)
- NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (maintenance and physical protection requirements)
- Performance Data engagement observations (first-hand: David Selakovic); method described under Infrastructure Resilience and Partner and White-Label Delivery.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days