CM.L3-3.4.3e

  • Requirement

    Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.

  • Discussion

    The system component inventory includes system-specific information required for component accountability and to provide support to identify, control, monitor, and verify configuration items in accordance with the authoritative source. The information necessary for effective accountability of system components includes the system name, hardware and software component owners, hardware inventory specifications, software license information, software version numbers, and— for networked components—the machine names and network addresses. Inventory specifications include the manufacturer, supplier information, component type, date of receipt, cost, model, serial number, and physical location. Organizations also use automated mechanisms to implement and maintain authoritative (i.e., up-to-date, complete, accurate, and available) baseline configurations for systems that include hardware and software inventory tools, configuration management tools, and network management tools. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels.

More Info

  • Title

    Automated Inventory

  • Domain

    Configuration Management

  • CMMC Level

    3

  • Further Discussion

    Organizations use an automated capability to discover components connected to the network and system software installed. The automated capability must also be able to identify attributes associated with those components. For systems that have already been coupled to the environment, they should allow remote access for inspection of the system software configuration and components. Another option is to place an agent on systems that performs internal system checks to identify system software configuration and components. Collection of switch and router data can also be used to identify systems on networks.

    Example

    Within your organization, you are in charge of implementing an authoritative inventory of system components. You first create a list of the automated technologies you will use and what each technology will be responsible for identifying [a]. This includes gathering information from switches, routers, access points, primary domain controllers, and all connected systems or devices, whether wired or wireless (printers, IoT, IIoT, OT, IT, etc.) [b]. To keep the data up to date, you set a very short search frequency for identifying new components. To maximize availability of this data, all information will be placed in a central inventory/configuration management system, and automated reporting is performed every day [c]. A user dashboard is set up that allows you and other administrators to run reports at any time.

    Potential Assessment Considerations

    • Can the organization explain the process by which current inventory information is acquired [a]?
    • Is the organization able to produce an inventory of components on the network [b,c]?
    • Has the organization implemented a valid frequency for the component discovery solution [b,c]?
    • Can the organization demonstrate that the inventory is current and accurate [b]?
    • Has the organization developed a defined list of identifiable attributes for each component type, and is that list adequate to support component accountability [a]?
    • Is the organization able to track, monitor, and verify configuration items in accordance with the organization’s authoritative list of components [b,c]?

NIST 800-172A Assessment Guidance

CMMC Training

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!

Learn More