A continuously updated CMDB is an output of which NIST function and category?

What must be done before returning a compromised laptop to normal operations in the environment?

You have completed a review of your current security baseline policy. In order to minimize financial, legal, and reputational damage, the baseline configuration requires that infrastructure be categorized for the BIA.
Which categorizations are necessary for the BIA?

What database is used to record and manage assets?

A company failed to detect a breach of their production system. The breach originated from a legacy system that was originally thought to be decommissioned. It turned out that system was still operating and occasionally connected to the production system for reporting purposes.
Which part of the process failed?