{"data":{"id":"CM-08","name":"System Component Inventory","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"a. Develop and document an inventory of system components that:\n1. Accurately reflects the system;\n2. Includes all components within the system;\n3. Does not include duplicate accounting of components or components assigned to any other system;\n4. Is at the level of granularity deemed necessary for tracking and reporting; and\n5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability]; and\nb. Review and update the system component inventory [Assignment: organization-defined frequency].","supplemental_guidance":"System components are discrete, identifiable information technology assets that include hardware, software, and firmware. Organizations may choose to implement centralized system component inventories that include components from all organizational systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information, and for networked components, the machine names and network addresses across all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include date of receipt, cost, model, serial number, manufacturer, supplier information, component type, and physical location.\n\nPreventing duplicate accounting of system components addresses the lack of accountability that occurs when component ownership and system association is not known, especially in large or complex connected systems. Effective prevention of duplicate accounting of system components necessitates use of a unique identifier for each component. For software inventory, centrally managed software that is accessed via other systems is addressed as a component of the system on which it is installed and managed. Software installed on multiple organizational systems and managed at the system level is addressed for each individual system and may appear more than once in a centralized component inventory, necessitating a system association for each software instance in the centralized inventory to avoid duplicate accounting of components. Scanning systems implementing multiple network protocols (e.g., IPv4 and IPv6) can result in duplicate components being identified in different address spaces. The implementation of CM-08(07) can help to eliminate duplicate accounting of components.","enhancements":[{"id":"CM-08(01)","name":"Updates During Installation and Removal","statement":"Update the inventory of system components as part of component installations, removals, and system updates.","baselines":["moderate","high"]},{"id":"CM-08(02)","name":"Automated Maintenance","statement":"Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].","baselines":["high"]},{"id":"CM-08(03)","name":"Automated Unauthorized Component Detection","statement":"a. Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency]; and\nb. Take the following actions when unauthorized components are detected: [Selection (one or more): disable network access by such components; isolate the components; notify [Assignment: organization-defined personnel or roles]].","baselines":["moderate","high"]},{"id":"CM-08(04)","name":"Accountability Information","statement":"Include in the system component inventory information, a means for identifying by [Selection (one or more): name; position; role], individuals responsible and accountable for administering those components.","baselines":["high"]},{"id":"CM-08(05)","name":"No Duplicate Accounting of Components","withdrawn":true,"incorporated_into":["CM-08"]},{"id":"CM-08(06)","name":"Assessed Configurations and Approved Deviations","statement":"Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.","baselines":[]},{"id":"CM-08(07)","name":"Centralized Repository","statement":"Provide a centralized repository for the inventory of system components.","baselines":[]},{"id":"CM-08(08)","name":"Automated Location Tracking","statement":"Support the tracking of system components by geographic location using [Assignment: organization-defined automated mechanisms].","baselines":[]},{"id":"CM-08(09)","name":"Assignment of Components to Systems","statement":"a. Assign system components to a system; and\nb. Receive an acknowledgement from [Assignment: organization-defined personnel or roles] of this assignment.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-08","name":"System Component Inventory","description":"a. Develop and document an inventory of system components that:\n1. Accurately reflects the system;\n2. Includes all components within the system;\n3. Does not include duplicate accounting of components or components assigned to any other system;\n4. Is at the level of granularity deemed necessary for tracking and reporting; and\n5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability]; and\nb. Review and update the system component inventory [Assignment: organization-defined frequency].","discussion":"System components are discrete, identifiable information technology assets that include hardware, software, and firmware. Organizations may choose to implement centralized system component inventories that include components from all organizational systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information, and for networked components, the machine names and network addresses across all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include date of receipt, cost, model, serial number, manufacturer, supplier information, component type, and physical location.\n\nPreventing duplicate accounting of system components addresses the lack of accountability that occurs when component ownership and system association is not known, especially in large or complex connected systems. Effective prevention of duplicate accounting of system components necessitates use of a unique identifier for each component. For software inventory, centrally managed software that is accessed via other systems is addressed as a component of the system on which it is installed and managed. Software installed on multiple organizational systems and managed at the system level is addressed for each individual system and may appear more than once in a centralized component inventory, necessitating a system association for each software instance in the centralized inventory to avoid duplicate accounting of components. Scanning systems implementing multiple network protocols (e.g., IPv4 and IPv6) can result in duplicate components being identified in different address spaces. The implementation of CM-08(07) can help to eliminate duplicate accounting of components.","related_controls":["CM-02","CM-07","CM-09","CM-10","CM-11","CM-13","CP-02","CP-09","MA-02","MA-06","PE-20","PL-09","PM-05","SA-04","SA-05","SI-02","SR-04"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Adds 'Does not include duplicate accounting of components or components assigned to any other system' Discussion of accountability expanded Incorporates withdrawn control CM-08(5)"}},"compliance_mappings":{"iso_27001_2022":["A.5.9","A.8.9"],"iso_27002_2022":["5.9","5.37","8.1","8.9"],"cobit_2019":["BAI09","BAI10"],"pci_dss_v4":["11.2","12.5"],"nist_csf_2":["ID.AM-01","ID.AM-02","ID.AM-07","ID.AM-08","PR.PS-01","PR.PS-03"],"cis_controls_v8":["CIS 1","CIS 1.1","CIS 1.2","CIS 1.3","CIS 1.5","CIS 2","CIS 2.1","CIS 2.4","CIS 3.2","CIS 16.4"],"soc2_tsc":["CC6.1-POF1"],"finos_ccc":["CCC-C06"],"iso_42001_2023":["A.4.2","A.4.4"],"iec_62443":[],"asd_e8":["E8-2 ML3","E8-6 ML3"],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 21"],"mas_trm":[],"pra_op_resilience":["SS1/21-5.2","SS2/21-13.1"],"bsi_grundschutz":[],"anssi":["Hygiene.5","Hygiene.8","SecNumCloud.9.1"],"osfi_b13":["B-13.2.1","B-13.3.1"],"finma_circular":["IV.A(28)","IV.A(29)","IV.A(30)","IV.B.c(54)","IV.B.c(55)"],"gdpr":["Art.30(1)","Art.35(7)(a)"],"dora":["Art.8(1)","Art.8(4)","Art.28(4)"],"bio2":["5.9","5.37","8.1","8.9"],"rbi_csf":["Annex1.1","ITGRCA.9"],"fisc":["FISC.O9","FISC.O13","FISC.T7"],"lgpd_bcb":["BCB.Art.20"],"hkma_tme1":[],"mlps_2":["8.1.10.1","8.1.10.6","8.2","8.3"],"dnb_good_practice":["DNB.6.1","DNB.13.1","DNB.13.2","DNB.19.3"],"cra":["CRA.II.1","CRA.Info.3"],"swift_cscf":["SWIFT.2.7"],"cbuae":["CR-7"],"nca_ecc":["2-1","2-6"],"qatar_nia":["AM","OS"],"sama_csf":["2.1"],"uae_ia":["T4","T7"],"bog_cisd":["CISD-V"],"bom_ctrm":["2.1","3.2","3.7"],"cbe_csf":["CRM-2"],"cbn_csf":["Part3.1"],"popia":["s17"],"sa_js2":["JS2-6.1","JS2-7.2"],"bcbs_239":["Principle 2","Principle 4"],"bot_cyber":["Ch2.1"],"cpmi_pfmi":["CG.ID","PFMI.P17"],"eba_ict":["3.3.2","3.4.4","3.5(a)","3.5(b)"],"ecb_croe":["CROE.2.2.2"],"ffiec_is":["II.C.5","II.C.11","II.C.13(e)"],"hipaa_sr":["§164.310(d)(1)","§164.310(d)(2)(iii)"],"iosco_cyber":["ID-1","ID-2","ID-4"],"nydfs_500":["500.13"],"sebi_cscrf":["ID.AM"],"cmmc_2":["CM"],"nerc_cip":["CIP-002-5.1a","CIP-010-4"],"nrc_73_54":["RG5.71-B-CM"],"tsa_psd":[],"ieee_1686":["5.4"],"ferc_cip":[],"doe_c2m2":["ASSET"],"api_1164":[],"awia":["AWWA Sec 2"],"iaea_nss":[],"pci_pts":["K"],"fips_140":[],"cbest":["CBEST.3"],"tiber_eu":[],"pci_hsm":["2"],"common_criteria":[],"isae_3402":["Clause 9"],"fca_sysc_13":["SYSC 13.7.1","SYSC 13.7.2"],"fda_21_cfr_11":["§11.10(h)"],"fda_cyber":["524B-1","SBOM-1","SBOM-2","SBOM-3","ST-4"],"hitrust_csf":["05.c","07.a","10.e"],"iso_27799":["8.1","11.2","H.3"],"lloyds_ms":["MS1.1","MS8.4","MS9.3"],"naic_ds":["3","4-asset"],"nhs_dspt":["NDG-5.3","NDG-8.1","NDG-8.3","NDG-9.7"],"pra_ss1_23":["P1.1","P1.3","P5.5","P-IT.3"],"solvency_ii":["DR.266-DataSec","EIOPA-ICT-4.3"],"owasp_masvs_v2":["MASVS-CODE-3"],"csa_ccm_v4":["CEK-21","DCS-05","DCS-06","DCS-08","DSP-03","STA-07","UEM-04","UEM-12"],"csa_aicm":["CEK-21","DCS-05","DCS-06","DCS-08","DSP-03","MDS-02","STA-07","STA-15","UEM-04","UEM-12"],"ccss_v9":["1.02.3","1.04.5"],"mica":["Art.40(1)","Art.63(2)","Art.82(1)"],"basel_sco60":["SCO60.14","SCO60.51","SCO60.65"],"bssc":["GSP-14","NOS-03"],"sec_custody_digital":["SEC-CD-04","SEC-CD-09","SEC-CD-18"],"dpdpa":[],"nist_ai_rmf_1":["GOVERN 1.6"],"eu_ai_act":[]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-26: hipaa_sr §164.310(d)(1) added from NIST's HIPAA Security Rule to SP 800-53 Rev 5.1.1 crosswalk (OLIR entry 110), which OSA's mapping now takes as its base. 2026-10-26: nerc_cip CIP-002-7 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-015","SP-017","SP-026","SP-029","SP-030","SP-038","SP-040","SP-044","SP-046","SP-047","SP-049","SP-050","SP-051","SP-053","SP-054"],"attack":{"techniques":101,"route":"/api/v1/controls/CM-08?fields=attack"}}}