ID.AM-08 focuses on managing all assets—systems, hardware, software, services, and data—across their entire life cycles, from deployment to disposal. This includes integrating cybersecurity considerations into acquisition, use, and retirement phases, ensuring consistent protection. It addresses risks like shadow IT or redundant systems that expand the attack surface.

This subcategory promotes secure configuration, timely updates, and proper disposal, such as data sanitization, to prevent vulnerabilities at any stage. It ensures inventories reflect asset movements or changes, maintaining accuracy over time. ID.AM-08 sustains a lifecycle approach to asset security and resilience.