{"data":{"id":"PM-05","name":"System Inventory","family":"PM","family_name":"Program Management","withdrawn":false,"description":"Develop and update [Assignment: organization-defined frequency] an inventory of organizational systems.","supplemental_guidance":"[OMB A-130] provides guidance on developing systems inventories and associated reporting requirements. System inventory refers to an organization-wide inventory of systems, not system components as described in CM-8.","enhancements":[{"id":"PM-05(01)","name":"Inventory of Personally Identifiable Information","statement":"Establish, maintain, and update [Assignment: organization-defined frequency] an inventory of all systems, applications, and projects that process personally identifiable information.","baselines":["privacy"]}],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"PM-05","name":"System Inventory","description":"Develop and update [Assignment: organization-defined frequency] an inventory of organizational systems.","discussion":"[OMB A-130] provides guidance on developing systems inventories and associated reporting requirements. System inventory refers to an organization-wide inventory of systems, not system components as described in CM-8.","related_controls":[],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Information System Inventory' to 'System Inventory'. Simplified description."}},"compliance_mappings":{"iso_27001_2022":["A.5.9"],"iso_27002_2022":["5.9"],"cobit_2019":["BAI09"],"pci_dss_v4":[],"nist_csf_2":["ID.AM-01","ID.AM-02","ID.AM-04"],"cis_controls_v8":["CIS 1","CIS 3.2","CIS 6.6","CIS 15.1"],"soc2_tsc":[],"finos_ccc":["CCC-C06"],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 21"],"mas_trm":[],"pra_op_resilience":["SS2/21-13.1"],"bsi_grundschutz":[],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":["5.9"],"rbi_csf":["Annex1.1","ITGRCA.9"],"fisc":["FISC.O1"],"lgpd_bcb":["BCB.Art.20"],"hkma_tme1":[],"mlps_2":["8.1.10.1"],"dnb_good_practice":["DNB.5.2","DNB.6.1","DNB.19.3"],"cra":["CRA.II.1","CRA.Info.7"],"swift_cscf":[],"nca_ecc":["2-1"],"qatar_nia":["AM","GV"],"sama_csf":["2.1"],"uae_ia":["T4"],"bog_cisd":["CISD-V"],"bom_ctrm":["2.1"],"cbe_csf":["CRM-2"],"cbn_csf":["Part3.1"],"sa_js2":["JS2-6.1"],"bcbs_239":["Principle 4","Principle 8"],"cpmi_pfmi":["CG.ID","PFMI.P3"],"eba_ict":["3.3.2","3.5(a)"],"ecb_croe":["CROE.2.2.1","CROE.2.2.2"],"ffiec_is":["II.C.1","II.C.5","II.C.13(e)"],"nydfs_500":["500.3","500.13"],"sebi_cscrf":["ID.AM"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["ASSET"],"api_1164":[],"awia":["AWWA Sec 2"],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":["Clause 1","Clause 9"],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["00.a","00.c","04.b","07.a"],"iso_27799":["8.1"],"lloyds_ms":[],"naic_ds":["3","4-asset"],"nhs_dspt":["NDG-5.3","NDG-8.1","NDG-8.3"],"pra_ss1_23":["P1.1"],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":["DSP-03","DSP-06"],"csa_aicm":["DSP-03","DSP-06"],"ccss_v9":["1.02.3"],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":["Act.11"]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-02-19","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings extracted from framework-coverage data","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-038","SP-040","SP-046"]}}