{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"operational","domain":["Asset Management & Inventory","Data Protection & Privacy"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aasset-inventory-gap","description":"No authoritative inventory of information and associated assets, missing ownership, acceptable-use, classification, labelling, or handling rules — preventing effective protection, risk assessment, and secure disposal.","details":{"category":"operational","impact":"medium","inherent_rating":"medium","likelihood":"high","risk_id":"asset-inventory-gap","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"id":"risk:asset-inventory-gap","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aasset-inventory-gap","sourceIds":["coso-ic","gdpr","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Incomplete asset inventory and classification","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:22b18eefbfe2be7c988d0b42b405a97fd092c6a8f9f6dfd40a29a68645341239","properties":{"rationale":"Classifying and labelling information/assets directly remediates the missing classification/labelling this risk names in its title and description.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-03-3e6216cd.json","sourceId":"uc:UC-ASSET-03","targetDetailPath":"/data/v1/records/risk-asset-inventory-gap-e18c7e73.json","targetId":"risk:asset-inventory-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:31d4766507f616a18e21915b3fccc99dee4b9c5f6529addfa16349a82f9f69f5","properties":{"rationale":"Defining, communicating, and acknowledging acceptable-use rules closes the missing acceptable-use dimension of the gap.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-06-d13d9c7f.json","sourceId":"uc:UC-ASSET-06","targetDetailPath":"/data/v1/records/risk-asset-inventory-gap-e18c7e73.json","targetId":"risk:asset-inventory-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:404449c161c2b2e1eb98e5875c84937f0cb1f6cb211b8cf3fe87f135c184d0cd","properties":{"rationale":"The data/information inventory component contributes to overall asset accountability; the systems inventory itself is UC-01.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/risk-asset-inventory-gap-e18c7e73.json","targetId":"risk:asset-inventory-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:41a41b2054adcbbaa667bcebefeb8b8ac9db3a5154c6d5979cd79351ebd5b41f","properties":{"rationale":"Maintaining the authoritative hardware/software/system inventory directly closes the missing-inventory gap this risk describes.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-01-04dbd5db.json","sourceId":"uc:UC-ASSET-01","targetDetailPath":"/data/v1/records/risk-asset-inventory-gap-e18c7e73.json","targetId":"risk:asset-inventory-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:59b31c82aace4f05706abfef1bd94bf5ad9fe809986400fe883a1f853c835ddd","properties":{"rationale":"Defined per-stage ownership plus issuance/return tracking supports the asset accountability the gap risk lacks.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-07-5039208b.json","sourceId":"uc:UC-ASSET-07","targetDetailPath":"/data/v1/records/risk-asset-inventory-gap-e18c7e73.json","targetId":"risk:asset-inventory-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:89ac9934e02b94d186d7d3aacf3e4b76d735a25f9a5b593c2107733ccc296ccb","properties":{"rationale":"Supplier-service inventory with named internal owners extends asset accountability to third-party services.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-05-11852f6d.json","sourceId":"uc:UC-ASSET-05","targetDetailPath":"/data/v1/records/risk-asset-inventory-gap-e18c7e73.json","targetId":"risk:asset-inventory-gap","type":"mitigates"}],"schemaVersion":1}