How do organisations know their asset management controls are working?

Why This Matters for Security Teams

Asset management controls are only useful when they produce evidence that the asset record matches reality. For non-human identities, that means service accounts, API keys, certificates, and automation tokens are visible, owned, and revocable. NHI Management Group’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs frames this as a lifecycle problem, not a spreadsheet problem. The gap matters because hidden credentials and orphaned assets undermine offboarding, rotation, and incident response at the same time.

In practice, teams often discover control failure only after an audit, a duplicate purchase, or a compromise, rather than through routine control testing. That is why practitioners also map the control to the NIST Cybersecurity Framework 2.0, where visibility and governance are treated as measurable outcomes, not assumptions. NHIs now outnumber human identities by 25x to 50x in modern enterprises, so unmanaged drift scales faster than manual review can keep up with. The signal of success is simple: fewer unknown assets, fewer duplicate records, and faster recovery when something is removed or replaced.

One useful benchmark from NHI Management Group is that only 5.7% of organisations have full visibility into their service accounts, which explains why many asset inventories look complete until they are tested against real systems.

How It Works in Practice

Effective asset management is a continuous verification loop. Asset discovery identifies what exists, reconciliation compares that list to procurement, directory, endpoint, cloud, and CI/CD records, and remediation closes the gap when an item is stale, duplicated, or unowned. For NHI-heavy environments, the same process must cover secrets inventory, because credentials are often embedded in code, config files, and pipelines rather than stored in a central vault. NHI Management Group’s Top 10 NHI Issues and the Ultimate Guide to NHIs — Regulatory and Audit Perspectives both emphasise that control evidence should be produced from system state, not after-the-fact attestations.

• Define a canonical asset record for each device, workload, and NHI, including owner, purpose, last-seen time, and expiry or rotation date.
• Reconcile that record against authoritative sources such as cloud inventory, IAM, CMDB, endpoint management, and secrets systems.
• Measure exceptions: ghost assets, duplicate entries, stale owners, expired certificates, and offboarding items that remain active.
• Track whether remediation actually completes, not just whether a ticket was opened.

For reporting, current guidance suggests using leading indicators and lagging indicators together: leading indicators include inventory completeness and time-to-owner, while lagging indicators include recovery time, duplicate procurement rate, and orphaned credential count. Where policy and telemetry disagree, telemetry should win unless the asset type lacks a reliable source of truth. That is why asset controls are strongest when paired with lifecycle governance and periodic control testing, not annual clean-up exercises.

These controls tend to break down in fast-moving cloud and CI/CD environments because assets can be created and discarded faster than manual reconciliation can register them.

Common Variations and Edge Cases

Tighter asset control often increases operational overhead, so organisations have to balance inventory accuracy against the cost of continuous reconciliation. That tradeoff becomes sharper when teams manage ephemeral infrastructure, contractor-owned devices, or autonomous workloads that create and retire identities on demand. Best practice is evolving here: some environments can rely on CMDB-style records, while others need event-driven discovery plus short-lived lifecycle state.

A few edge cases matter. Shared service accounts can mask ownership unless each use is tied back to a system or team. Certificates may look healthy in inventory while the underlying private key is already exposed. And some records are technically accurate but operationally useless because they never capture who can approve a change or who receives rotation alerts. For asset control to prove itself, the record must support action, not just compliance.

Where this breaks down most often is in hybrid estates with shadow IT and third-party managed services, because the organisation cannot verify what it does not instrument. In those cases, the control should be judged by reduction in unknowns over time, not by whether the asset register appears complete on paper.

Related resources from NHI Mgmt Group

• How do organisations know if configuration management is working?
• How can organisations know whether device posture controls are actually working?
• How do organisations know whether cloud access controls are actually working?
• How do organisations know if their IaC controls are actually working?