Inventory Level 4 servers on an annual basis. At a minimum, annually conduct a formal survey of server owners in your department and ask them to provide the following information for each server in their application portfolio:
- Business or Practice name
- Asset (server) name
- System location
- System purpose
- Type of Level 4 information stored, e.g. SSN, credit card, bank account, driver's license, state ID, passport or visa, or biometric data
- Type of environment, e.g. production, test, development
- Server type, e.g. physical or virtual
- Operating system