Asset
PCIComplianceHubLast updated
Anything of value to an entity that its security programme has to account for: hardware, software, data, and the people and processes around them. In PCI DSS the assets that matter are the in-scope system components, which 12.5.1 requires to be inventoried with a description of each one's function, because a system nobody has listed is a system nobody is protecting.
Applies to. 12.3.1 makes assets the starting point of every targeted risk analysis: each analysis identifies the assets being protected, the threats the requirement guards against and the factors that drive likelihood and impact, then justifies the chosen frequency or process, and is reviewed at least once every 12 months. Requirement 12 also requires an inventory of the system components in scope for PCI DSS with a description of each one's function, and keeping that inventory current is the entity's working list of assets.
Limits. 12.3.1 asks for the assets to be named inside each targeted risk analysis; it does not itself require an asset inventory, which is a separate Requirement 12 control.
In PCI DSS v4.0.1. 12.3.1
Related. System Component, Targeted Risk Analysis (TRA), Inventory Management, Scoping, Risk Assessment
Sources. PCI DSS v4.0.1 (June 2024)