CM-8(6)

Requirement

Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.

Discussion

Assessed configurations and approved deviations focus on configuration settings established by organizations for system components, the specific components that have been assessed to determine compliance with the required configuration settings, and any approved deviations from established configuration settings.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system design documentation; system component inventory; system configuration settings and associated documentation; change control records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with component inventory management responsibilities; organizational personnel with assessment responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes for managing the system component inventory; mechanisms supporting and/or implementing system component inventory].

ID	Assessment Objectives
CM-08(06)[01]	assessed component configurations are included in the system component inventory;
CM-08(06)[02]	any approved deviations to current deployed configurations are included in the system component inventory.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!