PM-5, System Inventory, asks you to develop and update, on a schedule you define, an inventory of organizational systems. It is short, and it underpins nearly every other control. You cannot assess, patch or monitor what you have not listed.
800-53 binds federal systems and others by contract. For other companies it is the answer to a common audit question: what systems are in scope?
What it means in practice
The record draws a line. System inventory is an organization wide inventory of systems, not of system components, which is CM-8. A system here is something like the billing application or the customer portal. A component is a server, library or device inside it.
The record points to OMB A-130 for guidance on inventories and associated reporting requirements in the federal setting. The record also lists PM-5.1, Inventory of Personally Identifiable Information, which adds an inventory of systems that process PII.
For a company, a workable inventory has one row per system with these columns: name, owner, purpose, environment, data classes handled, hosting location, key vendors, and criticality. If a system processes personal data, the PM-5.1 idea says to mark it so the privacy team can find it.
Keep it alive. The common failure is a spreadsheet built for the audit and never touched. Tie updates to events: a new service is not released until it has a row, and a decommissioned service is not closed until its row is retired.
Software components inside each system are a different layer. A software bill of materials per system gives you the CM-8 view and connects the inventory to vulnerability data.
Evidence to collect
- The system inventory with owners and data classes
- The procedure and schedule for updating it
- Change records that show a new system being added
- Decommission records
- For PM-5.1, a view or filter listing systems that process PII
- A reconciliation against cloud accounts, domains or SSO app lists
Common gaps
- Shadow systems adopted by teams never appear
- No owner is named for each system
- Data classes are missing so the privacy view is impossible
- The list was reconciled once and never again
- System inventory and component inventory are mixed together
How to implement it
- Define what counts as a system and write it down.
- Seed the list from cloud accounts, DNS, SSO and finance records.
- Add a gate in release and procurement that requires an inventory row.
- Reconcile quarterly against the same sources and fix the gaps.
- Generate an SBOM for each system to cover the component layer.
See it in a demo
Click through it at your own pace, or open it full screen.
Quick check
How is PM-5 different from CM-8?
PM-5 is an inventory of systems across the organization. CM-8 covers system components.
What does PM-5.1 add?
An inventory of personally identifiable information, so you can tell which systems process it.
