CM-8—Information System Component Inventory

PBMM (P1)

Secret (P1)

Operational

>Control Description

(A) The organization develops and documents an inventory of information system components that accurately reflects the current information system. (B) The organization develops and documents an inventory of information system components that includes all components within the authorization boundary of the information system. (C) The organization develops and documents an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting. (D) The organization develops and documents an inventory of information system components that includes ⚙organization-defined information deemed necessary to achieve effective information system component accountability. (E) The organization reviews and updates the information system component inventory ⚙organization-defined frequency.

>Supplemental Guidance

Organizations may choose to implement centralized information system component inventories that include components from all organizational information systems. In such situations, organizations ensure that the resulting inventories include system-specific information required for proper component accountability (e.g., information system association, information system owner). Information deemed necessary for effective accountability of information system components includes, for example, hardware inventory specifications, software license information, software version numbers, component owners, and for networked components or devices, machine names and network addresses.

Inventory specifications include, for example, manufacturer, device type, model, serial number, and physical location. Related controls: CM-2, CM-6.

>Tailoring Guidance

This security control/enhancement is considered to be best practice. Consequently, inclusion in a departmental profile is strongly encouraged in most cases.

Ask AI

Configure your API key to use AI features.