NIST 800-53 REV 5 • CONFIGURATION MANAGEMENT
CM-8(2) — Automated Maintenance
Maintain the currency, completeness, accuracy, and availability of the inventory of system components using {{ insert: param, cm-8.2_prm_1 }}.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
Organizations maintain system inventories to the extent feasible. For example, virtual machines can be difficult to monitor because such machines are not visible to the network when not in use. In such cases, organizations maintain as up-to-date, complete, and accurate an inventory as is deemed reasonable. Automated maintenance can be achieved by the implementation of [CM-2(2)](#cm-2.2) for organizations that combine system component inventory and baseline configuration activities.
Practitioner Notes
This enhancement requires automated tools to maintain your inventory — manual spreadsheets are not sufficient for keeping an accurate, real-time picture of your environment.
Example 1: Deploy Qualys Asset Inventory or Tenable.io to continuously discover and catalog all devices on your network, including shadow IT devices.
Example 2: Use Azure Resource Graph or AWS Config to automatically maintain an inventory of all cloud resources across all subscriptions and accounts.