For critical infrastructure organisations, maintaining an asset register is necessary. However, the register alone does not show whether critical systems are accurately classified, monitored, securely configured and covered by effective access controls. That limitation becomes more serious as environments change....