CCI-001780

The organization reviews and updates the information system component inventory per organization-defined frequency.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to review and update the information system component inventory at a minimum, annually. The organization must maintain an audit trail of review and update activity. DoD has defined the frequency as at a minimum, annually.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process for reviews and updates as well as the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the information system component inventory at a minimum, annually. DoD has defined the frequency as at a minimum, annually.

Compelling Evidence

1.) Signed and dated system security plan (SSP)

The controls below (if any) were marked by NIST as being related to CCI-001780.