Subcontrol 1.3

[adammontville]

Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address management tools to update the organization's hardware asset inventory.

Measures

M1 = # of log enabled DHCP server
M2 = # of total DHCP server

Metrics

DHCP-log ratio[0-1]= M1/M2

[adammontville]

Inputs:

• List of DHCP servers
• List of CMDB servers (i.e. asset inventory systems)

Operations:

• For each DHCP server, check whether DHCP logging is enabled
• For each CMDB server, check whether DHCP logs are used to update IP addresses

Measures:

• M1 - count of DHCP servers
• M2 - count of DHCP servers with logging enabled
• M3 - count of CMDB servers
• M4 - count of CMDB servers configured to use DHCP logs to update IP addresses

Metrics:

• M2 / M1 - Ratio of appropriately configured DHCP logging enabled to known DHCP servers
• M4 / M3 - Ratio of appropriately configured CMDB servers using DHCP logging to update IP addresses

Assumptions:

• CMDB servers are configured to pull from DHCP logs

[apiperCIS]

The wording of the measurement proposal suggests that the DHCP logs will only be used to update IP address information in the inventory. I read the Sub-Control as suggesting the DHCP logs could also potentially be used to identify devices that aren't in the inventory are at all. Thoughts?

[wmunyan]

Add: Inputs:

Operations:

Measures:

• M5 = Number of devices in the DHCP server logs that are not included in the CMDB servers

Metrics:

• M5 > 0 indicates a non up-to-date asset inventory