Assessment Objective
Determine if:
- an inventory of system components is developed and documented.
- the system component inventory is reviewed [Assignment: frequency].
- the system component inventory is updated [Assignment: frequency].
- the system component inventory is updated as part of component installations.
- the system component inventory is updated as part of component removals.
- the system component inventory is updated as part of system updates.
Assessment Methods
Examine
- configuration management policy and procedures
- procedures for system component inventory
- configuration management plan
- system design documentation
- system component inventory
- inventory reviews and update records
- component installation records
- change control records
- component removal records
- system change records
- system security plan
- other relevant documents or records
Interview
- personnel with component inventory management responsibilities
- personnel with information security responsibilities
- system administrators
Test
- processes for managing the system component inventory
- mechanisms for supporting or implementing the system component inventory
- processes for updating the system component inventory
- mechanisms for supporting or implementing the system component inventory updates
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | 03.04.10 System Component Inventory |