https://www.sans.org/reading-room/whitepapers/critical/critical-security-controls-software-designed-inventory-configuration-governance-37005