Identify · Foundational tier · IT Operations

ID-01Asset inventory matches the network

The asset inventory matches what is actually on the network, so every host is known, owned and protected.

Status

Partial evidence

3 items only partly support it.

Exposure

High

3 evidence items from 3 sources

CCSA · Identify

Below Foundational

This control blocks Foundational for the whole domain.

What the evidence shows

The branch refresh added 740 hosts that the CMDB does not hold, so the inventory is not authoritative.

Remediation · IT Operations

Reconcile the 740 hosts into the CMDB and make registration a gate in the branch imaging process.

Root cause: Branch workstation refresh. 740 hosts were imaged without CMDB registration or a healthy sensor.

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-id01-1

Falcon sees 740 hosts that the CMDB does not hold

CrowdStrike Falcon · telemetry · collected 1 h ago (Oct 15, 2026 · 12:59 UTC) · limit 48 h

Partial

ev-id01-2

CMDB holds 11,740 active endpoint records

ServiceNow ITSM · export · collected 22 h ago (Oct 14, 2026 · 15:59 UTC) · limit 48 h

Partial

ev-id01-3

Directory holds 12,610 enabled computers; 130 have no Falcon sensor

Microsoft Active Directory · telemetry · collected 2 h ago (Oct 15, 2026 · 11:59 UTC) · limit 48 h

Partial

Query: LDAP (&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
Identity: gmsa-assurance$ (read-only)
Collector: ad-collector 1.6.2
Window: 24 h
Records: 12,610
SHA-256: c1c67cc7e4b12bb208b2fe14d8c27d7dbc5bfa397ba8f2c01320e017b3d09038