Identity and Access Management
Book
MidPoint
- Compliance
  - ISO 27001
    - 5.1
    - 5.2
    - 5.3
    - 5.4
    - 5.5
    - 5.6
    - 5.7
    - 5.8
    - 5.9
    - 5.10
    - 5.11
    - 5.12
    - 5.13
    - 5.14
    - 5.15
    - 5.16
    - 5.17
    - 5.18
    - 5.19
    - 5.20
    - 5.21
    - 5.22
    - 5.23
    - 5.24
    - 5.25
    - 5.26
    - 5.27
    - 5.28
    - 5.29
    - 5.30
    - 5.31
    - 5.32
    - 5.33
    - 5.34
    - 5.35
    - 5.36
    - 5.37
    - 6.1
    - 6.2
    - 6.3
    - 6.4
    - 6.5
    - 6.6
    - 6.7
    - 6.8
    - 7.1
    - 7.2
    - 7.3
    - 7.4
    - 7.5
    - 7.6
    - 7.7
    - 7.8
    - 7.9
    - 7.10
    - 7.11
    - 7.12
    - 7.13
    - 7.14
    - 8.1
    - 8.2
    - 8.3
    - 8.4
    - 8.5
    - 8.6
    - 8.7
    - 8.8
    - 8.9
    - 8.10
    - 8.11
    - 8.12
    - 8.13
    - 8.14
    - 8.15
    - 8.16
    - 8.17
    - 8.18
    - 8.19
    - 8.20
    - 8.21
    - 8.22
    - 8.23
    - 8.24
    - 8.25
    - 8.26
    - 8.27
    - 8.28
    - 8.29
    - 8.30
    - 8.31
    - 8.32
    - 8.33
    - 8.34
Identity Connectors
Support
Trainings
Evolveum
Community
Library
Case Studies
Talks
Glossary
Frequently Asked Questions
About

ISO/IEC 27001 Control 5.9: Inventory of information and other associated assets

Control

An inventory of information and other associated assets, including owners, should be developed and maintained.

Necessity of MidPoint

MidPoint is optional for implementation of this control.

Implementation of this control without midPoint is feasible. However, midPoint provides considerable advantages for implementation of this control, making the implementation more efficient and reliable.

Implementation Overview

MidPoint can manage applications, roles and entitlements that are closely related to assets.

Implementation Details

Application inventory capability of midPoint is essential first step to catalog assets. MidPoint capability to maintain various relations of objects (object governance) can be used to track owners of applications, roles and other asset-related objects. Applications can be classified, setting classification-specific requirements and policies on applications by using policy rules. Applications without owners or classifications can be reported and displayed on dashboards. Application roles are linked to the application, enabling application-level policies to be applied to all users using the application. When a dedicated application inventory or asset management system is available, midPoint can automatically synchronize the data into its own repository, increasing automation. Organizations (orgs) can group applications (and other assets) in order to organize them and apply consistent policies.

Implementation Notes

Applications are "archetyped" services in midPoint. I.e. applications are services that have "Application" archetype applied.
Applications act as approximation of assets in current midPoint asset management model. This roughly aligns with the underlying technological representation of assets, and it is a practical method for many organizations. Dedicated concept of "asset" is likely to appear in future midPoint versions. Other service-like objects can be assets too (servers, devices, virtual machines), as can be organization-like objects (facilities, localities).
Users (personnel) are assets too, naturally "inventorized" in midPoint identity repository.

Rationale

MidPoint can coule application inventory and asset management with identity and access control management, providing visibility, automation and policy evaluation and enforcement. When necessary, midPoint can act as an application inventory system, even covering parts of asset management.

Was this page helpful?

YES NO

Thanks for your feedback