CCI-003966

Develop and document an inventory of system components that is at the level of granularity deemed necessary for reporting.

Implementation Guidance

Determine if an inventory of system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented.

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system design documentation; system component inventory; inventory reviews and update records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with component inventory management responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for managing the system component inventory; mechanisms supporting and/or implementing system component inventory].

The controls below (if any) were marked by NIST as being related to CCI-003966.