Navigate

CCI-001779

CCI-001779 Definition

Defines the frequency on which the system component inventory is to be reviewed and updated.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the system component inventory is reviewed and updated [CM-08_ODP[02]; frequency at which to review and update the system component inventory is defined].

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system design documentation; system component inventory; inventory reviews and update records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with component inventory management responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for managing the system component inventory; mechanisms supporting and/or implementing system component inventory].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001779.

Control	Description
CM-8	a: Develop and document an inventory of system components that: 1: Accurately reflects the system; 2: Includes all components within the system; 3: Does not include duplicate accounting of components or components assigned to any other system; 4: Is at the level of granularity deemed necessary for tracking and reporting; and 5: Includes the following information to achieve system component accountability: [information deemed necessary to achieve effective system component accountability is defined;] ; and b: Review and update the system component inventory [frequency at which to review and update the system component inventory is defined;].

Control

Description

CM-8

a: Develop and document an inventory of system components that:
- 1: Accurately reflects the system;
- 2: Includes all components within the system;
- 3: Does not include duplicate accounting of components or components assigned to any other system;
- 4: Is at the level of granularity deemed necessary for tracking and reporting; and
- 5: Includes the following information to achieve system component accountability: [information deemed necessary to achieve effective system component accountability is defined;] ; and

b: Review and update the system component inventory [frequency at which to review and update the system component inventory is defined;].