CIS Control 1 and 2: why is asset inventory the foundation?

What do CIS Control 1 and Control 2 require?

They require a firm to know every device and every piece of software it runs, and to deal with anything that should not be there. CIS Control 1 covers enterprise assets: laptops, desktops, phones, servers, network gear, IoT devices and cloud assets, whether they sit in the office, at someone's home or in a hosting provider. CIS Control 2 covers the software installed on them.

CIS puts the reason plainly in its explanation of Control 1: "Enterprises cannot defend what they do not know they have." Every other safeguard depends on the list these two Controls produce. Patching, encryption, backup, monitoring and incident response all assume someone already knows which machines and applications exist.

Which safeguards in Controls 1 and 2 are part of IG1?

Five of the twelve. Implementation Group 1 is the starting tier CIS describes as essential cyber hygiene, covered in our overview of the 56 IG1 safeguards. The IG1 safeguards in these two Controls are:

• Safeguard 1.1, a detailed enterprise asset inventory, reviewed and updated "bi-annually, or more frequently."
• Safeguard 1.2, a process to address unauthorized assets on a weekly basis, by removing them, denying them remote access or quarantining them.
• Safeguard 2.1, a software inventory recording title, publisher, install date and business purpose, also reviewed at least twice a year.
• Safeguard 2.2, confirmation that authorized software is still supported by its vendor, checked at least monthly.
• Safeguard 2.3, removal of unauthorized software, or a documented exception, reviewed monthly.

The rest are IG2 and IG3 safeguards: active and passive discovery tools (1.3 and 1.5), DHCP logging (1.4), automated software inventory tools (2.4), and allowlisting of applications, libraries and scripts (2.5 to 2.7). A small firm can meet IG1 without those, though an automated inventory tool usually makes 1.1 and 2.1 far easier to keep current.

What belongs in an enterprise asset inventory?

Every device that can store or process data, with enough detail to find it and hold someone accountable for it. Safeguard 1.1 lists the minimum fields: network address if static, hardware address, machine name, asset owner, department, and whether the asset is approved to connect to the network. For mobile devices, CIS suggests that mobile device management tools can support the process.

In practice, the inventory most firms already have is incomplete in predictable ways:

• Home office devices: personal printers and routers used for client work, and laptops that rarely come back to the office.
• Shared and conference room devices: front desk PCs, scanners and multifunction printers that store scanned documents.
• Cloud assets: virtual machines, file shares and admin consoles that nobody thinks of as hardware.
• Retired equipment: laptops sitting in a closet still holding cached email and client files.

An asset that is on the network but not on the list is exactly what Safeguard 1.2 exists to catch. The weekly review asks a simple question: what showed up that we did not approve?

Why does the software inventory matter as much as the hardware inventory?

Because unsupported software stops receiving security fixes, and you cannot retire what you have not listed. Safeguard 2.2 says only currently supported software should be authorized. If an unsupported application is necessary for the business, CIS expects a documented exception "detailing mitigating controls and residual risk acceptance." Without that exception, the software is treated as unauthorized.

The calendar makes this concrete this season. Microsoft's Office LTSC 2021 reached end of support on October 13, 2026, and Windows Server 2016 reaches the end of extended support in January 2027. A firm with a current software inventory can answer "where do we still run these?" in minutes. A firm without one finds out machine by machine, often after a vendor stops issuing security updates.

The software inventory also surfaces tools nobody approved: browser extensions, free file-transfer utilities, remote access tools installed for a one-time vendor visit, and AI assistants added by individual staff. Safeguard 2.3 asks the firm to remove them or document why they stay.

Why does an IT asset inventory matter to insurers and regulators?

Because the inventory is what makes every other security claim provable. When a cyber insurer asks how many endpoints have encryption and endpoint protection, the answer is a ratio, and the denominator comes from the inventory. When an incident happens, the first question from counsel and the forensic firm is which systems held the affected data.

The same list does regulatory work. California's reasonable security statute, Civil Code section 1798.81.5, does not define its key term, and California's Attorney General said in its 2016 data breach report that failing to adopt the CIS Controls "would be indicative of a failure to provide reasonable security." Frameworks that apply to specific industries ask for the same foundation in their own words. The FTC Safeguards Rule requires covered firms to identify and manage the data, personnel, devices, systems and facilities that support the business, and the HIPAA Security Rule's risk analysis has to account for every system that holds electronic protected health information.

How do you build an inventory that stays current?

Pull from the systems that already see your devices, reconcile them once, then assign an owner and a review date. Most firms already have three or four partial lists. The work is joining them.

• Export devices from your endpoint management or remote monitoring tool, your Microsoft 365 or Entra device list, and your endpoint protection console.
• Compare the exports. A device that appears in one list but not another is either retired, unmanaged or unprotected, and each answer leads to a different fix.
• Walk the office for printers, scanners, network gear and conference room equipment that agents do not cover.
• Export installed software from the same management tool and flag anything past its vendor's support date.
• Record an owner and department for each asset, so a lost laptop leads straight to a person.

What should you do this quarter?

Get the five IG1 safeguards in place and dated, because a dated record is what turns an inventory into evidence.

• Produce one reconciled hardware inventory with the Safeguard 1.1 fields, and record the date of the review.
• Set a weekly check for unauthorized devices, using your management tool's new-device report or your firewall's DHCP leases.
• Produce a software inventory, mark every item with its vendor support status, and list every Office 2021 and Windows Server 2016 instance with a retirement date.
• Write a short exception for any unsupported software you must keep, naming the mitigating controls and who accepted the risk.
• Put the next two semi-annual reviews on the calendar now, with a named owner.

How does s90 help?

s90 maintains hardware and software inventories for professional firms in Los Angeles and Orange County as part of managed IT, reconciles them against management and security tools, and tracks support dates so retirements are planned well ahead. If you would like to see how complete your current inventory is against CIS Controls 1 and 2, we are happy to walk through it with you.