# Component Inventory

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/component-inventory/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| System | System owner | Inventory tool or location | Last reviewed | Reviewed by |
| --- | --- | --- | --- | --- |
| [Fill in: system name and identifier, as in the system inventory] | [Fill in: name and title] | [Fill in: tool, or this register] | [Fill in: date] | [Fill in: name and title] |

## 1. How to use this inventory

- List every component within the system's authorization boundary: physical and virtual servers, end-user devices, network and security devices, storage, operating systems, firmware, software, container images, cloud resources and services the organization configures, and issued portable storage devices (CM-8a.1, a.2).
- Record each component once, in this system only. A component shared by several systems belongs to the system whose owner is responsible for it, and the others reference it (CM-8a.3).
- Record components at the level of detail needed to track and report on them, for example each server and laptop individually and each software product by version (CM-8a.4).
- Record [Fill in: information deemed necessary to achieve effective system component accountability. Typical: name, type, manufacturer and model, serial number or asset tag, software version, location, network address, owner and administrator] for each component (CM-8a.5).
- Update the inventory as part of each installation, removal and system update, through the change request that makes it (CM-8(1)).
- Review and update the whole inventory [Fill in: frequency at which to review and update the system component inventory. Typical: at least quarterly], and record the review in section 5 (CM-8b).
- Keep disposed components in the register with the status "disposed", the date and the media sanitization record ID, so their history supports audits (MP-6).

| Field | What to record |
| --- | --- |
| Inventory ID | A unique, permanent ID for the component |
| Component name | Host name, device name or product name |
| Type | For example physical server, virtual machine, laptop, network device, mobile device, portable storage device, operating system, application, firmware, container image, cloud resource |
| Manufacturer and model | The manufacturer and model, or the publisher and product for software |
| Serial number or asset tag | The serial number, asset tag, or cloud resource ID |
| Software and version | The operating system, firmware or software version, with the product identifier (CPE) where the tools provide it |
| Configuration item | The configuration item in the system's Configuration Management Plan |
| Secure configuration | The benchmark it follows from the baseline configuration standard |
| Location | The building and room, or the cloud provider, account and region |
| Network address | The IP address, host name or MAC address, as the component has them |
| Owner | The role and organizational unit responsible for the component |
| Administrator | The role responsible and accountable for administering it (CM-8(4)) |
| Assigned user | For a laptop, mobile device or portable storage device issued to a person: that person and the date issued (PE-16, MP-7) |
| Status | Received (not yet connected), in service, issued, spare, under maintenance, or disposed |
| Received or added | The date the component arrived or was added, and the change request ID |
| Vendor support ends | The date the vendor stops providing security updates (SA-22) |
| Last seen | The date discovery or endpoint management last saw the component |

## 2. Receiving and issuing components

- Record an arriving component with the status "received" once it has been checked against the purchase order or shipping record and for signs of tampering in the delivery area, and before it is connected to any network (PE-16a).
- Connect it only after it has been configured to its secure baseline and its record is complete, then change the status to "in service" (CM-6b, CM-8(1)).
- Record each laptop, mobile device and portable storage device issued to a person with that person as the assigned user and the date issued. Devices recorded this way may leave and return with their user without a record of each trip (PE-16a, MP-7b).
- Record the return of each issued device when the person transfers or leaves, using the [onboarding, transfer and termination checklist](https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/) (PS-4, PS-5).
- Record components leaving for maintenance in the [maintenance log](https://kston83.github.io/nist-guide/templates/forms/maintenance-log/), and set the status to "under maintenance" until they return (MA-2).

## 3. Reconciliation and unauthorized components

- Compare the inventory with the [system inventory](https://kston83.github.io/nist-guide/templates/forms/system-inventory/) at each review, to confirm the system's boundary and that no component is recorded under another system (CM-8a.3, PM-5).
- Compare the inventory with discovery scans, endpoint management reports, the cloud provider's resource lists and the vulnerability scan's list of hosts found, [Fill in: frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system. Typical: continuously, and at least weekly by scan], to detect the presence of unauthorized hardware, software and firmware components (CM-8(3)(a)).
- Detection uses [Fill in: automated mechanisms. Typical: network access control, asset discovery scans and endpoint management tools] (CM-8(3)(a)).
- When an unauthorized component is detected, [Select one or more: disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: organization-defined personnel or roles]. Typical: disable network access by unauthorized components, and notify the security operations team]; then remove it, or add it through a change request if it should stay (CM-8(3)(b)).
- Investigate inventory entries the scans did not find: a component that is missing, switched off or out of the scans' reach is recorded as such, so vulnerability scans are not reported as complete when they are not (RA-5).
- Record each reconciliation in the table below.

| Date | Sources compared | Found by the sources, not in the inventory | In the inventory, not found by the sources | Duplicates, or recorded in another system | Actions taken | By |
| --- | --- | --- | --- | --- | --- | --- |
| [Fill in: date] | [Fill in: for example discovery scan, endpoint management, cloud resource list, vulnerability scan, system inventory] | [Fill in: components, or none] | [Fill in: entries, or none] | [Fill in: entries, or none] | [Fill in: for example network access disabled, removed, added by change request ID] | [Fill in: name] |

This paragraph applies to High systems.

- The inventory is kept current, complete, accurate and available using [Fill in: automated mechanisms. Typical: asset discovery and endpoint management tools that feed the inventory] (CM-8(2)). It identifies, by [Select one or more: name; position; role. Typical: role], the individuals responsible and accountable for administering each component (CM-8(4)).

## 4. Issued portable storage devices

Each portable storage device the organization issues is a row in the register, with its assigned user. Personally owned devices are never recorded here, because they may not be connected to organizational systems, and a device found with no known owner is turned in, without being connected, to the [Security operations team] (MP-7). The [baseline configuration standard](https://kston83.github.io/nist-guide/templates/standards/baseline-configuration-standard/) blocks portable storage on servers and allows only these issued devices elsewhere.

## 5. Reviews

| Review date | Reviewed by | Components added, removed or corrected since the last review | Issued devices confirmed with their users | Issues and actions | Next review |
| --- | --- | --- | --- | --- | --- |
| [Fill in: date] | [Fill in: name and title] | [Fill in: number, with change request IDs] | [Fill in: number confirmed, and any not accounted for] | [Fill in: issues, or none] | [Fill in: date] |

### Federal systems

CISA [Binding Operational Directive 23-01](https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks), Improving Asset Visibility and Vulnerability Detection on Federal Networks (October 3, 2022), applies to federal civilian executive branch unclassified information systems, including those operated by another entity on an agency's behalf, but not to national security systems or certain Department of Defense and Intelligence Community systems. It requires automated asset discovery every 7 days, covering at least the entire IPv4 space the agency uses, and vulnerability enumeration across all discovered assets, including roaming devices such as laptops, every 14 days. Results go into the CDM Agency Dashboard within 72 hours of discovery completion, and agencies must be able to run on-demand discovery within 72 hours of a CISA request. Its scope excludes ephemeral assets, such as containers, and third-party-managed software-as-a-service. As of October 2026, it remains in effect.

- For a system within BOD 23-01's scope, automated asset discovery shall run at least every 7 days and cover the IPv4 space the system uses, and its results shall be reconciled with this inventory under section 3. (CM-8(3))
- Every asset found shall be recorded in this inventory or handled as an unauthorized component, so the vulnerability enumeration every 14 days covers every asset BOD 23-01 requires. (CM-8, RA-5)

## Register

| Inventory ID | Component name | Type | Manufacturer and model | Serial number or asset tag | Software and version | Configuration item | Secure configuration | Location | Network address | Owner | Administrator | Assigned user | Status | Received or added | Vendor support ends | Last seen |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: name] | [Fill in: type] | [Fill in: manufacturer and model] | [Fill in: serial, tag or resource ID] | [Fill in: software and version] | [Fill in: CI ID] | [Fill in: benchmark] | [Fill in: location] | [Fill in: address] | [Fill in: owner] | [Fill in: administrator role] | [Fill in: person and date issued, or none] | [Fill in: status] | [Fill in: date and change request ID] | [Fill in: date] | [Fill in: date] |