Skip to main content

💼 CM-8 System Component Inventory (L)(M)(H)

  • Contextual name: 💼 CM-8 System Component Inventory (L)(M)(H)
  • ID: /frameworks/fedramp-moderate-security-controls/cm/08
  • Located in: 💼 Configuration Management

Description​

a. Develop and document an inventory of system components that:

  1. Accurately reflects the system;

  2. Includes all components within the system;

  3. Does not include duplicate accounting of components or components assigned to any other system;

  4. Is at the level of granularity deemed necessary for tracking and reporting; and

  5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability]; and

b. Review and update the system component inventory [FedRAMP Assignment: at least monthly].

CM-8 Additional FedRAMP Requirements and Guidance:

Requirement: must be provided at least monthly or when there is a change.

Similar​

  • Sections
    • /frameworks/fedramp-high-security-controls/cm/08
  • Internal
    • ID: dec-c-522d70ef

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 FedRAMP High Security Controls → 💼 CM-8 System Component Inventory (L)(M)(H)42

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CM-8(1) Updates During Installation and Removal (M)(H)
💼 CM-8(3) Automated Unauthorized Component Detection (M)(H)

Policies (2)​

PolicyLogic CountFlags
📝 AWS Account Config is not enabled in all regions 🟢1🟢 x6
📝 Google Cloud Asset Inventory API is not enabled 🟢1🟢 x6