Why Asset Inventory Is a SOC 2 Requirement

CC6.1 of the SOC 2 Trust Services Criteria requires that you restrict logical access to information assets. You cannot restrict access to assets you haven't identified. An asset inventory is the prerequisite for all access control — you need to know what you have before you can decide who can access it.

Auditors review asset inventory as part of scoping discussions (what's in scope?) and access review verification (access to what, exactly?). The most common finding: teams have an AWS infrastructure but no documented inventory of what systems exist, who owns them, and what data they process.

What Counts as an Asset

For SOC 2, "assets" span four categories:

Infrastructure assets — every component of your technical stack:

• AWS accounts and regions in use
• EC2 instances (with instance IDs, roles, tags)
• RDS databases (with instance identifiers and what data they store)
• S3 buckets (with purpose and data classification)
• Lambda functions
• Kubernetes clusters (EKS/GKE/AKS)
• Third-party SaaS tools with production data access

Endpoint assets — devices that access your production systems:

• Employee laptops (with device ID, owner, OS version, encryption status)
• Company-provided mobile devices
• Any device with access to production credentials or data

Data assets — categories of data you store and process:

• Customer personal data (names, emails, payment information)
• Business confidential data (code, intellectual property)
• Authentication credentials and secrets
• Audit logs and compliance evidence

Software assets — the applications and services you run:

• Production application codebases with version and deployment status
• Third-party libraries and dependencies (feeds into vulnerability management)
• Internal tools with access to production data

Asset Classification

Classify each asset by data sensitivity — this drives access control decisions:

Sensitive / High: Contains customer PII, payment data, authentication credentials, or audit logs. Requires encryption at rest, strict access controls, and access review quarterly.

Confidential / Medium: Contains internal business data, source code, or operational data. Requires access controls and annual review.

Public / Low: Contains publicly accessible information. Minimal additional controls required.

Tag every AWS resource with a data-classification tag — this makes automated policy enforcement possible and gives auditors an immediate answer to "how do you classify your resources?"

Keeping Your Inventory Current

An asset inventory is only useful if it reflects current reality. Stale inventories are worse than no inventory — they give you false confidence and mislead auditors.

Automatic discovery:

• Use AWS Config or Cloud Asset Inventory (GCP) to auto-discover resources
• Use an MDM solution for endpoint inventory
• Export from SecureSpect's integrations for cloud resource inventories

Quarterly review process:

Pull current resource list from SecureSpect / cloud console

Compare against the documented inventory

Add new resources, remove decommissioned ones, update classifications

Document the review date and reviewer

New resource onboarding checklist:

Every new production resource should be added to the inventory before deployment — make it part of your infrastructure-as-code PR checklist.

The Relationship Between Asset Inventory and Access Reviews

Asset inventory and access reviews are deeply connected. Your quarterly access review (CC6.1) reviews access to specific assets. If your asset inventory is incomplete, your access review is incomplete.

Link the two: for each system in your asset inventory, document who has access. During the access review, verify that access lists are still appropriate. This creates a complete chain: here are our assets → here's who can access them → we reviewed it on [date].

SecureSpect Asset Inventory

SecureSpect's Asset Inventory module provides a centralized registry for infrastructure, endpoint, and software assets. AWS resources discovered by SecureSpect's checks are automatically added to the inventory — you see every S3 bucket, EC2 instance, and RDS database in one place, tagged with their compliance posture. Add endpoint and software assets manually or via CSV import. Each asset links to the controls and access reviews that govern it.