Inventory Level 4 servers appropriately

Inventory Level 4 servers on an annual basis. At a minimum, annually conduct a formal survey of server owners in your department and ask them to provide the following information for each server in their application portfolio:

  • Business or Practice name
  • Asset (server) name
  • System location
  • System purpose
  • Type of Level 4 information stored, e.g. SSN, credit card, bank account, driver's license, state ID, passport or visa, or biometric data
  • Type of environment, e.g. production, test, development
  • Server type, e.g. physical or virtual
  • Operating system