Assessment Objective
Determine if:
- CM-08(01)[01] the inventory of system components is updated as part of component installations;
- CM-08(01)[02] the inventory of system components is updated as part of component removals;
- CM-08(01)[03] the inventory of system components is updated as part of system updates.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing system component inventory
- configuration management plan
- system security plan
- system component inventory
- inventory reviews and update records
- change control records
- component installation records
- component removal records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with component inventory updating responsibilities
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Organizational processes for updating the system component inventory
- mechanisms supporting and/or implementing system component inventory updates
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | CM-08(01) [H] Updates During Installation and Removal |