← GLBA · Safeguards Rule (16 CFR 314)
314.4(c)(2) — Inventory of data, personnel, devices and systems
Requirement
The institution identifies and manages the data, personnel, devices, systems and facilities that enable it to achieve business purposes, in accordance with their relative importance to business objectives and the organisation's risk strategy.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| ISO 27001 | A.5.9 | Inventory of information and other associated assets | asset-management inventory |
| NIST CSF 2.0 | ID.AM-01 | Inventories of hardware are maintained | asset-management inventory |
| NIST CSF 2.0 | ID.AM-02 | Inventories of software, services and systems are maintained | asset-management inventory |
| GDPR | Art.30 | Records of processing activities | inventory |
| PCI DSS 4.0.1 | 12.5.2 | PCI DSS scope documented and confirmed annually | inventory |
| HIPAA | 164.310(d)(1) | Device and media controls (R) | asset-management |
| NIST CSF 2.0 | ID.AM-05 | Assets are prioritised by criticality | asset-management |