CCI-000410

Implementation Guidance

The organization being inspected/assessed documents and implements a process to update the inventory of information system components as an integral part of information system updates. The organization must maintain an audit trail of updates. The audit trail may be recorded within the inventory itself.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process for updates as well as the audit trail of updates and the log of changes to the information system to ensure the organization being inspected/assessed updates the inventory of information system components as an integral part of information system updates.

Compelling Evidence

1.) Signed and dated system security plan (SSP) 2.) Audit trail of hardware list updates