CM-8(4)

Requirement

Include in the system component inventory information, a means for identifying by [Selection (one or more): name; position; role], individuals responsible and accountable for administering those components.

Discussion

Identifying individuals who are responsible and accountable for administering system components ensures that the assigned components are properly administered and that organizations can contact those individuals if some action is required (e.g., when the component is determined to be the source of a breach, needs to be recalled or replaced, or needs to be relocated).

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system component inventory; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with component inventory management responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes for managing the system component inventory; mechanisms supporting and/or implementing the system component inventory].

ID	Assessment Objectives
CM-08(04)	individuals responsible and accountable for administering system components are identified by <CM-08(04)_ODP SELECTED PARAMETER VALUES> in the system component inventory.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!