Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > System Component Inventory

System Component Inventory

Discussion: Summarize the component inventory provided in the [SP800-53] CM-08,
System Component Inventory, control implementation. System components are
discrete, identifiable information technology assets that represent the building blocks of
a system, including hardware, software, and firmware. Organizations can associate
distinct hardware and software components with specific system elements defined in
the authorization boundary. Identify the criticality of individual system components,
particularly those that support mission-critical functions or multiple system elements.
The component inventory presented in the privacy plan can support an understanding
of the components that participate in the business process flows and the data
transactions that involve individual PII data elements. While specific technical details
about the components are generally included as part of the security plan, the privacy
plan can associate specific privacy-related data flows with individual components or
groups of components (e.g., databases, applications, file storage arrays) which are
subject to privacy management requirements.
• Hardware component description
o Component function and role
o Unique component identifier (e.g., serial number, asset tracking identifier, other
service codes that identify supply chain information, designation for physical or
virtual implementation)
o Manufacturer and model, including sub-model identifiers or distinctions (e.g.,
subcomponent country of origin)
o Deployment date, warranty duration, expiration date, and maintenance support
contract status
o Specific physical locations (e.g., room number, rack and slot number) or logical
locations for virtualized components either hosted on-premises or using external
third-party services
o Differentiate between physical and virtual "hardware" components that host the
software products that support organizational missions, business functions, and
mission/business processes
• Software product description
o Purpose
o Product type (e.g., COTS, GOTS)
o Software developer, manufacturer, vendor, and version or build information, as
indicated in the Software Bill of Materials (SBOM)
o Secure software development attestation13
o Product license
Type (e.g., single user, volume license, public license, freeware)
Expiration date/renewal date
Component installation location
o Software warranty and maintenance support contract status
The validation of the SBOM can be addressed as part of the control implementation for
the retention and management of the software inventory. Reviews of other supplier-
provided component inventory lists can provide a way to also check for manifestless
components, which may contain additional vulnerabilities. [SP800-53] SR-04,
Provenance, provides guidelines for acquiring information about the
provenance/pedigree14 of the software and firmware included in the inventory.
13 [SP800-218] discusses the Secure Software Development Framework (SSDF), which supports the provisions of [EO14028] for ensuring the
secure functionality of software. [OMBM-26-05] provides flexibility for how an agency can confirm the implementation of specific security
practices in the development of software products accounting for associated hardware risks.
14 Per [SP 800-53], provenance is "the chronology of the origin, development, ownership, location, and changes to a system or system
component and associated data." Pedigree refers to "the validation of the internal composition and provenance of technologies, products, and
services."
The capture date of the inventory summary can convey the timeliness of the summary
related to continuous monitoring activities, system plan approval, and system
authorization. Automation may be used to generate a summary from the authoritative
inventory data repository.
Provide a reference to the authoritative system component inventory data repository.
The system component inventory is often distinct from the organization's physical
inventory, which may be handled through a distinct procurement and property
management repository. For instance, the system component inventory accounts for
hardware as well as instances of virtualized components on host devices that may not
be included in the physical inventory repository.
Related plan elements: Authorization Boundary Description, Environment of Operation
Diagrams