Navigate

PM-5

PM-5: System Inventory

Develop and update [the frequency at which to update the inventory of organizational systems is defined;] an inventory of organizational systems.

Supplemental

[OMB A-130](#27847491-5ce1-4f6a-a1e4-9e483782f0ef) provides guidance on developing systems inventories and associated reporting requirements. System inventory refers to an organization-wide inventory of systems, not system components as described in [CM-8](#cm-8).

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
DAF Baseline, Privacy (accountability), Privacy (high), Privacy (low), Privacy (moderate), Privacy Control Baseline (CNSSI 1253)

CSF Categories
ID.AM-1, ID.AM-4

Related Controls

The controls below (if any) were marked by NIST as being related to PM-5.

Control	Description
No controls

Enhancements

The controls below (if any) add on to the requirements of PM-5.

Control	Description
PM-5(1)	Establish, maintain, and update [the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined;] an inventory of all systems, applications, and projects that process personally identifiable information.

Related CCIs

The CCIs below are tied to PM-5.

CCI	Definition
CCI-004328	Develop an inventory of organizational systems.
CCI-004329	Update, on an organization-defined frequency, an inventory of organizational systems.
CCI-004330	Defines the frequency with which to update the inventory of organizational systems.