CCI-001780

Implementation Guidance

The organization being inspected/assessed documents and implements a process to review and update the information system component inventory at a minimum, annually. The organization must maintain an audit trail of review and update activity. DoD has defined the frequency as at a minimum, annually.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process for reviews and updates as well as the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the information system component inventory at a minimum, annually. DoD has defined the frequency as at a minimum, annually.

Compelling Evidence

1.) Signed and dated system security plan (SSP)