CCI-000420

The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.

Implementation Guidance

The organization being inspected/assessed will institute procedures to ensure assessed component configurations, and any approved deviations to current deployed configurations, are included in the information system component inventory.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the organization's configuration management policy and plan; procedures addressing information system component inventory; information system design documentation; information system inventory records; information system component installation records; and any other relevant documents or records. The purpose of the reviews is to validate the organization is including assessed component configurations, and any approved deviations to deployed configurations, in the information system component's inventory.

Compelling Evidence

1.) Information System Component Inventory, which documents assessed component configurations, and any approved deviations to current deployed configurations

The controls below (if any) were marked by NIST as being related to CCI-000420.