NIST Privacy Framework, Identify-PID.IM-P1

Maintain an updated inventory of the technology assets that support business processes or functions, which may include third-party assets that store or process your information or provide critical business services, and classify the assets by criticality.

Register the assets in your high-impact and critical-impact perimeters in an asset inventory that is kept apart from the risk assessment report (Article 26(7)).

Identify, classify and document all ICT supported business functions, the information assets and ICT assets that support them and their dependencies, and review that classification at least yearly. Identify all sources of ICT risk on a continuous basis and review the risk scenarios that affect you at least yearly. Map the assets you consider critical, and identify the processes that depend on ICT third-party service providers. Unless you are a microenterprise, perform a risk assessment on each major change in your network and information system infrastructure and at least yearly on all legacy ICT systems (Article 8).

Designate a qualified staff member as ICT Security Officer (Υ.Α.Σ.Π.Ε.), who manages communications with the National Cybersecurity Authority and coordinates compliance and incident reporting internally, keep a unified cybersecurity policy (an essential entity submits it to the Authority for approval at least annually), and keep an inventory of your information and communication assets ranked by criticality.

Survey and register every electronic information system, central service and supporting system you use, appoint or designate the person responsible for the security of those systems, classify them into a security category, and apply protective measures proportionate to their risk.

Keep a cybersecurity governance document set made up of a cybersecurity policy, a catalogue of your ICT resources and information systems, a cyber-risk-management and ICT-business-continuity plan and a cyber incident log (point 21), and review the policy at least once in three years (point 28).

Update the catalogue of ICT resources and information systems within one month of a change, and assign each information system a confidentiality, integrity and availability security class of A, B or C (points 31 and 32).

The Department states that you are required to dispose of nonpublic information that is no longer necessary for business operations or other legitimate business purposes, including nonpublic information used for AI purposes, and says that, although not required until November 1, 2025, you should maintain and update data inventories and should identify all information systems that use or rely on AI and maintain an inventory of them.

The Department says you are required to maintain an accurate and current asset inventory, and that the inventory should serve as the foundational input to the risk assessment, with consideration of where nonpublic information resides, how it flows through your information systems, who has access to assets and how assets are protected.

Keep a centrally managed register of your primary and supporting assets, their owners and the persons responsible for identifying and recording them, and keep it current (§ 6).

A standardized institution should, at a minimum, provide OSFI with an inventory of all models in use and identify and assess its most material models.

You should identify and track all models in use or recently decommissioned, including vendor and third-party models, and keep every model with non-negligible inherent model risk in a model inventory that is comprehensive, maintained at the enterprise level, accurate and updated in a timely manner.

At a minimum, maintain for each identified model its ID, name and description of key features and use, model risk rating, owner, developer and origin, and for each model in the inventory also its version, deployment date, reviewer, approver, dependencies, data sources, approved uses, limitations, most recent review date, monitoring status and next review date.

Your AIS Program should document your risk identification, mitigation, and management framework and internal controls, including inventories and descriptions of Predictive Models, validation, testing, and retesting, protection of non-public information, and data and record retention (guidelines 3.1 to 3.7).

If you are an operator of essential services, a digital service provider or a local government organization using such devices, use them in accordance with the technical security specifications, appoint an Internet of Things Security Officer, keep a register of the devices you use and update it annually, suspend use of a device that presents a risk, and carry out a data protection impact assessment of the related processing (Articles 35, 37(2), 38 and 41(2)).