N.6.10 Maintaining an overview of supplied equipment and software
Control Overview
This control mandates that organizations maintain an accurate, validated, and continuously updated asset inventory of all technical components, physical equipment, and software instances supplied to customers. Having clear visibility into the customer-facing deployment footprint allows the organization to perform proactive maintenance, track configuration life cycles, identify emerging vulnerabilities, and rapidly push targeted security updates.
Applicability Note: This control is fully applicable to the anDREa platform. It ensures that the lifecycle and configuration of all virtual environments generated for clients are explicitly inventoried and managed.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement operates within our ISO/IEC 27001-based ISMS, distinguishing between physical hardware dependencies and software-defined virtual infrastructure.
Because anDREa operates as a pure Software-as-a-Service (SaaS) platform, the supply of physical on-premises equipment (such as physical servers, routers, or on-site hardware appliances) is formally classified as out of scope. Instead, our asset management framework adapts to the cloud-native nature of our platform by tracking assets across two distinct domains:
- Customer Virtual Infrastructure (Delivered Software Landscapes): All localized research virtual machines (VMs), database nodes, computational storage blocks, and logical Workspaces dynamically provisioned for customers are automatically cataloged. Real-time configuration tracking is achieved through the myDRE Insights portal and individual Tenant Configurations manifests. This ensures administrators can see exactly what technical configurations are active within any client workspace at any moment.
- Internal Corporate Footprint: Corporate-issued user endpoints (employee laptops) and standard business software tooling are systematically cataloged within the anDREa People – Asset Overview matrix and the master Inventory List, subject to scheduled, recurring verification audits.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.05.09 - Inventory of information and other associated assets | Mandates that an inventory of information and other associated assets, including repositories of information, is identified and maintained. |
| ISO/IEC 27001 | A.08.09 - Configuration management | Regulates the definition, tracking, and drift-monitoring of software environment configurations. |
| Virtual Assets | myDRE Insights Platform Telemetry | The administrative dashboard tracking all active client workspaces, compute clusters, and storage footprints. |
| Tenant Tracking | Tenant Configurations | The technical registry capturing specific security rules and infrastructure definitions assigned to individual client entities. |
| Corporate Assets | Asset Overview | The definitive internal hardware and software allocation ledger tracking company-issued endpoints and system access keys. |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. The dynamic tracking of software-defined customer environments via platform telemetry, paired with formalized internal asset registers, completely fulfills the control criteria. No further remediation is required.