CM.L3-3.4.3e  

Reference: CMMC v2.13

Family: CM

Level Introduced: 3

Title: Automated Inventory

Practice:
Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.

Further Discussion:
Organizations use an automated capability to discover components connected to the network and system software installed. The automated capability must also be able to identify attributes associated with those components. For systems that have already been coupled to the environment, they should allow remote access for inspection of the system software configuration and components. Another option is to place an agent on systems that performs internal system checks to identify system software configuration and components. Collection of switch and router data can also be used to identify systems on networks.

Example
Within your organization, you are in charge of implementing an authoritative inventory of system components. You first create a list of the automated technologies you will use and what each technology will be responsible for identifying [a]. This includes gathering information from switches, routers, access points, primary domain controllers, and all connected systems or devices, whether wired or wireless (printers, IoT, IIoT, OT, IT, etc.) [b]. To keep the data up-to-date, you set a very short search frequency for identifying new components. To maximize availability of this data, all information will be placed in a central inventory/configuration management system, and automated reporting is performed every day [c]. A user dashboard is set up that allows you and other administrators to run reports at any time.

Potential Assessment Considerations
• Can the organization explain the process by which current inventory information is acquired [a]?
• Is the organization able to produce an inventory of components on the network [b,c]?
• Has the organization implemented a valid frequency for the component discovery solution [b,c]?
• Can the organization demonstrate that the inventory is current and accurate [b]?
• Has the organization developed a defined list of identifiable attributes for each component type, and is that list adequate to support component accountability [a]?
• Is the organization able to track, monitor, and verify configuration items in accordance with the organization’s authoritative list of components [b,c]?

Source: CMMC v2.13