Citation Audit

Citation: Discover and inventory the existing environment ¶ 1 – The first step any organization should take on its zero trust journey is to identify all of its assets by determining what resources it has in its existing environment (hardware, software, applications, data, and services). This may involve deploying tools that monitor traffic to discover what resources are active and being accessed and used. It is necessary to have a complete understanding and inventory of the organization's resources because these are the entities that the ZTA will be designed to protect. If resources are overlooked, it's likely that they won't be appropriately protected by the ZTA. They could be vulnerable to exfiltration, modification, deletion, denial-of-service, or other types of attack. It is imperative that all of the organization's resources, whether on-premises or cloud-based, be identified and inventoried.

Control: CC ID 689 – Establish, implement, and maintain an Information Technology inventory with asset discovery audit trails.