CCI-000410

Implementation Guidance

Determine if: - the inventory of system components is updated as part of component installations. - the inventory of system components is updated as part of component removals. - the inventory of system components is updated as part of system updates.

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing system component inventory; configuration management plan; system security plan; system component inventory; inventory reviews and update records; change control records; component installation records; component removal records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with component inventory updating responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for updating the system component inventory; mechanisms supporting and/or implementing system component inventory updates].