How to Create an Asset and Control Inventory
How to Create an Asset and Control Inventory
1 PagesThis guide explains how to build a foundational AppSec inventory. The diagram on page 1 shows asset types (code, services, endpoints, etc.) and how controls map to them. Step 1 focuses on identifying all assets and their ownership, criticality, and visibility. Step 2 maps security controls (e.g., SAST, DAST, WAF, CI/CD security) to each asset type using frameworks like NIST or OWASP SAMM. It emphasizes that full visibility is essential for gap analysis and prioritization. The key takeaway is that a complete asset and control inventory is the foundation for identifying security gaps and building an effective AppSec strategy.
