{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Asset Management & Inventory","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-ASSET-02","description":"Maintain inventories of data and corresponding metadata for designated data types, together with records of processing activities capturing purposes, data categories, recipients, retention periods, and safeguards as required by applicable privacy regulation. Maintain representations of authorized network communications and internal and external data flows, such as data-flow diagrams. Review and update these records upon significant change and at least annually so management relies on complete, quality information.","details":{"control_category":"administrative","control_type":"preventive","domain":"Asset Management & Inventory","guidance":[],"members":[{"control_id":"ID.AM-03","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"ID.AM-07","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"GDPR-Art30","coverage":"full","framework":"gdpr","relationship":"superset_of"},{"control_id":"P13","coverage":"partial","delta":"COSO expects quality information supporting all internal control components","framework":"coso-ic","relationship":"intersects_with"}],"statement":"Maintain inventories of data and corresponding metadata for designated data types, together with records of processing activities capturing purposes, data categories, recipients, retention periods, and safeguards as required by applicable privacy regulation. Maintain representations of authorized network communications and internal and external data flows, such as data-flow diagrams. Review and update these records upon significant change and at least annually so management relies on complete, quality information.","title":"Inventory data and document processing activities and flows","unified_id":"UC-ASSET-02"},"id":"uc:UC-ASSET-02","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-ASSET-02","sourceIds":["coso-ic","gdpr","nist-csf-2"],"sourceUrl":null,"title":"UC-ASSET-02 — Inventory data and document processing activities and flows","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0949cbf5ff89acd092a172df423483a87ae05c2841fcaf75d3009d1c497aef3c","properties":{"control_id":"ID.AM-03","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-id-am-03-2699376f.json","targetId":"ctrl:nist-csf-2:ID.AM-03","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:24fcb37e8ee5b67b82cb6c7391df09c40e071bab48ece129a6a4722941993873","properties":{},"sourceDetailPath":"/data/v1/records/wf-c38-485b6728.json","sourceId":"wf:C38","targetDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","targetId":"uc:UC-ASSET-02","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:404449c161c2b2e1eb98e5875c84937f0cb1f6cb211b8cf3fe87f135c184d0cd","properties":{"rationale":"The data/information inventory component contributes to overall asset accountability; the systems inventory itself is UC-01.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/risk-asset-inventory-gap-e18c7e73.json","targetId":"risk:asset-inventory-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:521a89a1ca7581bbd368a446574c3a54f920420d19d82a0f4a5512f7200a8cd7","properties":{"control_id":"P13","coverage":"partial","delta":"COSO expects quality information supporting all internal control components","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p13-0c70843b.json","targetId":"ctrl:coso-ic:P13","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:960d0f0d80955dfcf6ff9d5494af149cc09ad90267ced52de0c441b7a6fa5258","properties":{"control_id":"GDPR-Art30","coverage":"full","delta":null,"framework":"gdpr","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2016/679"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/ctrl-gdpr-gdpr-art30-e7db10f3.json","targetId":"ctrl:gdpr:GDPR-Art30","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb9ab1025acf6800c2e99cf9e7284c0062c5e338301e2c4cd9b5ed13424002f2","properties":{"rationale":"Maintaining data inventories, RoPA, and data-flow diagrams directly produces the authoritative data-flow record this risk says is absent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/risk-data-inventory-flows-unmapped-fd7746f8.json","targetId":"risk:data-inventory-flows-unmapped","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cff3b8245f8231de3d52036c0a05fd391983738874d5727c494713d2d3eefc26","properties":{"control_id":"ID.AM-07","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-id-am-07-9bbd0c1f.json","targetId":"ctrl:nist-csf-2:ID.AM-07","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fbfcb5c905c7ea133b0eb5b6dc8caf7a696625cfc78c062ac6fd83be10792acc","properties":{},"sourceDetailPath":"/data/v1/records/wf-c7-acbef2ee.json","sourceId":"wf:C7","targetDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","targetId":"uc:UC-ASSET-02","type":"oversees"}],"schemaVersion":1}