NIST CSF 2.0, IdentifyID.AM-02

Maintain an updated inventory of the technology assets that support business processes or functions, which may include third-party assets that store or process your information or provide critical business services, and classify the assets by criticality.

Register the assets in your high-impact and critical-impact perimeters in an asset inventory that is kept apart from the risk assessment report (Article 26(7)).

Identify, classify and document all ICT supported business functions, the information assets and ICT assets that support them and their dependencies, and review that classification at least yearly. Identify all sources of ICT risk on a continuous basis and review the risk scenarios that affect you at least yearly. Map the assets you consider critical, and identify the processes that depend on ICT third-party service providers. Unless you are a microenterprise, perform a risk assessment on each major change in your network and information system infrastructure and at least yearly on all legacy ICT systems (Article 8).

Designate a qualified staff member as ICT Security Officer (Υ.Α.Σ.Π.Ε.), who manages communications with the National Cybersecurity Authority and coordinates compliance and incident reporting internally, keep a unified cybersecurity policy (an essential entity submits it to the Authority for approval at least annually), and keep an inventory of your information and communication assets ranked by criticality.

Survey and register every electronic information system, central service and supporting system you use, appoint or designate the person responsible for the security of those systems, classify them into a security category, and apply protective measures proportionate to their risk.

Keep a cybersecurity governance document set made up of a cybersecurity policy, a catalogue of your ICT resources and information systems, a cyber-risk-management and ICT-business-continuity plan and a cyber incident log (point 21), and review the policy at least once in three years (point 28).

Update the catalogue of ICT resources and information systems within one month of a change, and assign each information system a confidentiality, integrity and availability security class of A, B or C (points 31 and 32).

The Department states that you are required to dispose of nonpublic information that is no longer necessary for business operations or other legitimate business purposes, including nonpublic information used for AI purposes, and says that, although not required until November 1, 2025, you should maintain and update data inventories and should identify all information systems that use or rely on AI and maintain an inventory of them.

The Department says you are required to maintain an accurate and current asset inventory, and that the inventory should serve as the foundational input to the risk assessment, with consideration of where nonpublic information resides, how it flows through your information systems, who has access to assets and how assets are protected.

Keep a centrally managed register of your primary and supporting assets, their owners and the persons responsible for identifying and recording them, and keep it current (§ 6).

Make the product identify the software installed on it that is necessary for it to operate safely and provide that information at all times in an easily accessible form, and collect evidence of a legitimate or illegitimate intervention in that hardware component, in the software, or in a modification of the software or its configuration (section 1.1.9).