NIST plans to publish the final public draft of Special Publication 800-53, Revision 5 (Security and Privacy Controls for Information Systems and Organizations) on 09-04-18. Final publication expected on 12-27-18.
If you can’t produce an asset list then save the money you would have spent on pentests and download a copy of the CIS Top 20 Controls. Then start at the top, where it says to create an asset list.
The CIA leaker conducted a privilege escalation on the computer he used to access the data he stole, erased all the logs of his activity, and then locked other users out