Subject: [sacm] SACM in support of “Asset management” in compliance with ISO 27001

From: [email-masked]
Date: Thu, 09 Aug 2012 08:55:22 -0500 (CDT)

Luis and all:

The new SCAP 1.2 (SACM) is adding two specifications (or formats for those who have a bad taste of the term specification) associated with assets.  These specs are the Asset Identification (AI) and Asset Reporting Format (ARF).  The three specifications which developers should use for this purpose should be AI, ARF, and CPE (Common Platforms Enumeration).

SACM Asset Management applications which map their output to ISO 27001 sections A.7.1.1 “Inventory of Assets”, A.7.1.2 “Ownership of Assets”, and A.7.1.3 “Acceptable use of assets” will be of great appeal to international business organizations.

Note also that, in general, asset management is not only a security issue, but a good business practice issue as well.  Thus, the strategic objectives of security and business “get married “at this point.

David Oliva

---

From: David Solin <[email-masked]>
Date: Thu, 9 Aug 2012 07:31:38 -0700

David,

Doesn't Verizon already use a CIM-based CMDB for asset management, ITSM and Helpdesk functions - at least in some parts of the business? Can you elaborate on the benefits of introducing another standard?

Regards,
David Solin

Sent from my iPhone