If you can only fix one control before an audit, fix this one. Nearly every other control assumes you know what you have. You cannot patch, harden, monitor or retire a component that is not on a list.
CM-8 asks you to develop and document an inventory of system components. 800-53 binds US federal systems and others by contract. For a small or mid size company it is a reference, and asset inventory is among the first things a customer or auditor requests.
What the control asks
The inventory must meet five conditions.
- It accurately reflects the system.
- It includes all components within the system.
- It has no duplicate accounting of components, and no components assigned to another system.
- It is at the level of granularity you need for tracking and reporting.
- It holds the information you define for component accountability.
You also review and update it at a frequency you define.
NIST defines components as discrete, identifiable IT assets that include hardware, software and firmware. The guidance lists useful fields. System name, software owners, version numbers, license information, hardware specifications, and for networked components the machine names and network addresses. Other fields include date of receipt, cost, model, serial number, manufacturer, supplier, component type and physical location. It says a unique identifier per component is how you prevent duplicate accounting.
What it means in practice
Modern inventory has layers. Cloud accounts, virtual machines, containers and images, databases and managed services form one layer. Laptops and mobile devices form another. Software in the form of applications, libraries and packages forms a third.
The third layer is where teams are weakest. A software inventory for an application is an SBOM, a list of every component and version in the build. It answers what is inside, which is the first question after any new vulnerability disclosure.
Evidence to collect
- The inventory export, with fields, unique identifiers, owners and dates.
- Discovery tool configuration showing which accounts, networks and repositories are scanned.
- A reconciliation between discovered assets and the register, with differences resolved.
- Review records showing the last scheduled update.
- SBOMs for in scope applications.
- Records of updates when components were installed or removed, which CM-8.1 describes.
Common gaps
- A spreadsheet maintained by hand and stale within a month.
- Cloud accounts that were never connected to discovery.
- Software inventory limited to top level packages, missing transitive dependencies.
- No owner field, so findings have nowhere to go.
- Duplicates from the same asset under different names.
- Shadow assets, such as a forgotten test cluster, that never appear.
How to implement it
- Pick the sources of truth. Cloud provider APIs, endpoint management, source repositories and registries.
- Pull from them automatically into one register and assign each asset a unique ID.
- Require an owner for every entry. Unowned assets go to a triage queue.
- Generate an SBOM at build time for each application.
- Compare discovered items to the register on a schedule and ticket the gaps.
The enhancements show how far you can take it. CM-8.1 is Updates During Installation and Removal. CM-8.2 is Automated Maintenance. CM-8.3 is Automated Unauthorized Component Detection. CM-8.4 is Accountability Information. CM-8.5 is No Duplicate Accounting of Components. CM-8.6 is Assessed Configurations and Approved Deviations. CM-8.7 is Centralized Repository. CM-8.8 is Automated Location Tracking.
The demo below shows asset discovery building an inventory from connected sources.
Click through it at your own pace, or open it full screen.
Try it yourself
To see the software layer quickly, run a manifest through the free in-browser dependency scan at gold.safeguard.sh/scan. It lists the packages in your project and flags known vulnerabilities, which is a small version of a software inventory.
Mapping to other frameworks
Asset management criteria appear in SOC 2, ISO 27001 and others, with different scope and wording. Mappings vary, so check an authoritative crosswalk for the versions you use.
Quick check
How do I prevent duplicate accounting of components?
Give each component a unique identifier and assign it to one system. The guidance names unique identifiers as the effective method.
Is a software inventory part of CM-8?
Yes. Components include hardware, software and firmware, and the information you track includes version numbers and license information.
