asset
termgovernance & riskops culture
Something an organisation owns or depends on that is worth protecting - and, in practice, something it has to know exists.
Inventory is where security programmes quietly fail, because every other control is scoped by it: patching covers what is listed, monitoring watches what is listed, and the machine nobody recorded is the one still running the old version. Cloud and remote work made this permanently harder, since anything can be created in minutes by someone with a card. The honest metric is not the size of the inventory but its drift - how long something can exist before the register knows.
Also known as: inventory, cmdb