U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.


Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

NIST SP 1800-5 (Initial Public Draft)

IT Asset Management: Financial Services

Date Published: October 2015
Comments Due: January 8, 2016 (public comment period is CLOSED)
Email Questions to: financial_nccoe@nist.gov


Michael Stone (NIST), Chinedum Irrechukwu (MITRE), Harry Perper (MITRE), Devin Wynne (MITRE)


Leah Kauffman (NIST)


NIST's NCCoE program is excited to announce the release of the latest NIST Cybersecurity Practice Guide, "IT Asset Management" for the Financial Services sector. The document is a draft, and NIST welcomes your comments and feedback (see links below for comment form page).

What's the guide about?

Financial institutions deploy a wide array of information technology devices, systems, and applications across a wide geographic area. While these physical assets can be labeled and tracked using bar codes and databases, understanding and controlling the cybersecurity resilience of those systems and applications is a much larger challenge. Not being able to track the location and configuration of networked devices and software can leave an organization vulnerable to security threats. Additionally, many financial organizations include subsidiaries, branches, third-party partners, and contractors as well as temporary workers and guests; tracking and managing hardware and software across these groups adds another layer of complexity.

To address this cybersecurity challenge, NCCoE security engineers developed an example solution that allows an organization to centrally monitor and gain deeper insight into their entire IT asset portfolio with an automated platform. Using open source and commercially available technologies, this example solution addresses questions such as "What operating systems are our laptops running?" and "Which devices are vulnerable to the latest threat?"

The example solution gives companies the ability to track, manage, and report on information assets throughout their entire life cycle. This can ultimately increase cybersecurity resilience by enhancing the visibility of assets, identifying vulnerable assets, enabling faster response to security alerts, revealing which applications are actually being used, and reducing help desk response times.



financial sector; asset management; information technology asset management (ITAM); information technology  ; ; physical security; cybersecurity; operational security; personnel security
Control Families

Access Control; Assessment, Authorization and Monitoring; Identification and Authentication; Incident Response; Risk Assessment


Draft SP 1800-5

Supplemental Material:
Project homepage

Document History:
10/26/15: SP 1800-5 (Draft)
09/07/18: SP 1800-5 (Final)


Security and Privacy

incident response, risk assessment