CM-8(9)

Requirement
1. Assign system components to a system; and
2. Receive an acknowledgement from [Assignment: organization-defined personnel or roles] of this assignment.

Discussion

System components that are not assigned to a system may be unmanaged, lack the required protection, and become an organizational vulnerability.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system design documentation; system component inventory; change control records; acknowledgements of system component assignments; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with component inventory management responsibilities; system owner; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes for assigning components to systems; organizational processes for acknowledging assignment of components to systems; mechanisms implementing assignment of components to the system; mechanisms implementing acknowledgment of assignment of components to the system].

ID	Assessment Objectives
CM-08(09)(a)	system components are assigned to a system;
CM-08(09)(b)	an acknowledgement of the component assignment is received from <CM-08(09)_ODP personnel or roles>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!