Asset management

Catalog reference

Have an adopted policy for managing the assets you use for your work or to provide your services, put it in writing and apply it demonstrably (art. 16(1)). The policy covers at least a system to classify assets at different levels, where applicable on the requirements for confidentiality, integrity and availability, and rules for the acceptable use of your assets (art. 16(2)). Set processes and procedures for managing your assets, and apply them demonstrably (art. 16(3)). Keep a complete and current inventory of your assets (art. 16(4)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Narrative — how we satisfy this requirement