What asset details are the most relevant in a cyber security risk assessment procedure?

Question

I am identifying organisation assets for a cyber security risk assessment. I am looking for guides or industry best practices for what asset details are actually useful for the risk assessment procedure.

We can easily get a lot of information on hardware and software assets by running scripts. We will store all of it, because we never know what we might need. However, in the scope of a cyber security risk assessment, some of it will not be useful. For example: I understand that server IP addresses are important security-wise, but motherboard manufacturer and model name are not so much.

Is there a concrete set of asset details that are most relevant for an asset report for a security risk assessment discussion?

Or, equivalently,

Is there a set of asset details that are "too much", that can be safely omitted from the asset report?

Answer 1

You are tackling this problem backwards. You assess risks against threats. The threats inform you of what is relevant.

Is your risk that the hardware has a built-in backdoor from the government of the manufacturer's country? Then, yes, "motherboard manufacturer and model name" are crucial pieces of data.

Gathering tons and tons of data hoping that some piece of it might be useful is not the way to go. Figure out your threats then assess against them. There is no set standard to follow.

Sometimes an expert can help you add to the list of relevant items because they might understand the threats a little better than you do, so do not discount outside help, papers, or reports. That's why Threat Intel is a vital part of a risk process.