ID.AM-04 requires organizations to keep inventories of supplier-provided services, such as IaaS, PaaS, SaaS, and APIs, used in their operations. This tracking ensures awareness of external dependencies that could introduce risks if not properly managed. It provides a basis for monitoring and securing third-party service usage.

This subcategory enhances oversight by updating inventories whenever new services are adopted, aligning them with cybersecurity risk management efforts. It helps identify critical external services that require heightened scrutiny or contractual safeguards. ID.AM-04 strengthens supply chain visibility within asset management.