System Component Inventory CM-8

Source: NIST SP 800-53 Rev.5, Configuration Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CM-8 (System Component Inventory) requires developing and maintaining an accurate, current inventory of system components — hardware, software, and firmware — with enough detail (such as version and owner) to manage them, and updating it as components are installed, removed, or updated. It is required from Low up into Moderate.

What good looks like

• Maintain an inventory of components: hardware, software and packages, versions, and network location.
• Record enough detail to manage each item — a unique identifier and an owner or responsible role.
• Update the inventory as part of installs, removals, and updates, so it stays current rather than one-time.
• Review the inventory for accuracy on a schedule and flag or remove any unauthorized components.

Framework mapping

• NIST CSF 2.0 — ID.AM-02 — Software, services, and systems managed by the organization are inventoried
• CIS Controls v8 — Control 2 — Inventory and Control of Software Assets

How to move it toward Implemented

• The as-built snapshot captures listening ports (ss -tulpn), running services, /etc/passwd login users, and Fail2Ban jails — a useful point-in-time picture, but not a maintained inventory.
• Generate a full software inventory with dpkg -l (or apt list --installed) saved as a dated file, add owner or role attribution, and keep it under change control.
• Wire the inventory to change events — regenerate it on install and removal (an apt hook or a scheduled job) — so it stays current, closing CM-8's 'update as components change' requirement.
• Attach the maintained inventory naming CM-8 in the Requirement field to move this asset from partial toward Completed.