I am identifying organisation assets for a cyber security risk assessment. I am looking for guides or industry best practices for what asset details are actually useful for the risk assessment procedure.
We can easily get a lot of information on hardware and software assets by running scripts. We will store all of it, because we never know what we might need. However, in the scope of a cyber security risk assessment, some of it will not be useful. For example: I understand that server IP addresses are important security-wise, but motherboard manufacturer and model name are not so much.
Is there a concrete set of asset details that are most relevant for an asset report for a security risk assessment discussion?
Or, equivalently,
Is there a set of asset details that are "too much", that can be safely omitted from the asset report?