AM-03—Inventory Reconciliation: ARP Table

>Control Description

Organization reconciles network discovery scans against the established device inventory on a quarterly basis; non-inventoried devices are assigned an owner.

Theme

Process

Type

Preventive

Policy/Standard

Asset Management Policy

>Implementation Guidance

1. Design and document a process for conducting network discovery scans on a periodic basis. 2. Ensure the results of the scans are reconciled with the system asset inventory at least quarterly. 3. Ensure necessary actions are taken to include non-inventoried assets in the inventory with appropriate ownership details.

>Testing Procedure

1. Inspect network discovery scans result to ensure periodic scans were conducted. 2. Observe the reconciliation report of network discovery scans against the established device inventory to determine that the inventories are reconciled on a quarterly basis. 3. Inspect the device inventory to ensure non-inventoried devices have been added and have a designed owner.