ID.AM-07 requires maintaining inventories of designated data types—like PII, health information, or intellectual property—along with metadata such as provenance and ownership. This ongoing effort ensures organizations know where sensitive data resides and how it’s classified, critical for compliance and security. It supports tracking data across systems and locations.

This subcategory enhances data protection by enabling continuous discovery and tagging of sensitive information, reducing the risk of overlooked exposures. It provides a foundation for managing data risks, such as breaches or misuse, throughout its lifecycle. ID.AM-07 strengthens data governance within asset management.