CM-7(9)

Requirement
1. Identify [Assignment: organization-defined hardware components authorized for system use];
2. Prohibit the use or connection of unauthorized hardware components;
3. Review and update the list of authorized hardware components [Assignment: organization-defined frequency].

Discussion

Hardware components provide the foundation for organizational systems and the platform for the execution of authorized software programs. Managing the inventory of hardware components and controlling which hardware components are permitted to be installed or connected to organizational systems is essential in order to provide adequate security.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; network connection policy and procedures; configuration management plan; system security plan; system design documentation; system component inventory; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system hardware management responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational process for approving execution of binary or machine-executable code; mechanisms supporting and/or implementing the prohibition of binary or machine-executable code].

ID	Assessment Objectives
CM-07(09)(a)	<CM-07(09)_ODP[01] hardware components> are identified;
CM-07(09)(b)	the use or connection of unauthorized hardware components is prohibited;
CM-07(09)(c)	the list of authorized hardware components is reviewed and updated <CM-07(09)_ODP[02] frequency>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!