Establish a process to identify devices and software in use at the organisation

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

• System purpose and linked responsibilities
• System's data location (covered in a separate task)
• System's maintenance and development responsibilities and linked partners (covered in a separate task)
• When necessary system's access roles and authentication methods (covered in a separate task)
• When necessary systems interfaces to other systems (covered in a separate task)

The devices must be registered in the mobile device management system in order to obtain a unique identifier for the device and to use the management features. When purchasing new devices, the devices are always registered in the mobile device management system.