CM-8(1)

Requirement

Update the inventory of system components as part of component installations, removals, and system updates.

Discussion

Organizations can improve the accuracy, completeness, and consistency of system component inventories if the inventories are updated as part of component installations or removals or during general system updates. If inventories are not updated at these key times, there is a greater likelihood that the information will not be appropriately captured and documented. System updates include hardware, software, and firmware components.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system component inventory; inventory reviews and update records; change control records; component installation records; component removal records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with component inventory updating responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes for updating the system component inventory; mechanisms supporting and/or implementing system component inventory updates].

ID	Assessment Objectives
CM-08(01)[01]	the inventory of system components is updated as part of component installations;
CM-08(01)[02]	the inventory of system components is updated as part of component removals;
CM-08(01)[03]	the inventory of system components is updated as part of system updates.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!