CCI-003967

Develop and document an inventory of system components that includes organization-defined information deemed necessary to achieve effective system component accountability.

Implementation Guidance

Determine if an inventory of system components that includes [CM-08_ODP[01]; information deemed necessary to achieve effective system component accountability is defined] is developed and documented.

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system design documentation; system component inventory; inventory reviews and update records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with component inventory management responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for managing the system component inventory; mechanisms supporting and/or implementing system component inventory].

The controls below (if any) were marked by NIST as being related to CCI-003967.