CM-8 Information System Component Inventory (L) (M) (H) The organization: Develops and documents an inventory of information system components that: Accurately reflects the current information system; Includes all components within the authorization boundary of the information system; Is at the level of granularity deemed necessary for tracking and reporting; and Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and Reviews and updates the information system component inventory [FedRAMP Assignment: at least monthly]. CM-8 Additional FedRAMP Requirements and Guidance: Requirement: Must be provided at least monthly or when there is a change. CM-8 Control Summary Information Responsible Role: Parameter CM-8 (a)(4): Parameter CM-8 (b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-8 What is the solution and how is it implemented? Part a Part b
CM-8 Information System Component Inventory (L) (M) (H) The organization: Develops and documents an inventory of information system components that: Accurately reflects the current information system; Includes all components within the authorization boundary of the information system; Is at the level of granularity deemed necessary for tracking and reporting; and Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and Reviews and updates the information system component inventory [FedRAMP Assignment: at least monthly]. CM-8 Additional FedRAMP Requirements and Guidance: Requirement: Must be provided at least monthly or when there is a change. CM-8 Control Summary Information Responsible Role: Parameter CM-8 (a)(4): Parameter CM-8 (b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-8 What is the solution and how is it implemented? Part a Part b
FedRAMP-SSP-High-Baseline-Template.docx