# System Inventory

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/system-inventory/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The system inventory lists every system the security program is responsible for. It is the starting point for authorization, continuous monitoring and reporting: a system that is not on it has no owner, no authorization and no assessment. Assessors compare it with authorization records, network scans and the list of cloud services in use, and look for systems missing from it. CM-8 is a different inventory: the components inside one system. Keep the register in a spreadsheet or a GRC tool; it is also downloadable as a CSV file.

| Organization | Maintained by | Last updated | Updated by |
| --- | --- | --- | --- |
| [Organization name] | [Chief Information Security Officer] | [Fill in: date] | [Fill in: name and title] |

## How to use this register

- Add a system when it is first planned, and before it is authorized or placed in operation (PM-5).
- Update the register [Fill in: the frequency at which to update the inventory of organizational systems. Typical: quarterly, and whenever a system is authorized, significantly changed or retired] (PM-5).
- Mark each system that processes personally identifiable information, and review those entries with the [Senior privacy official] [Fill in: the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information. Typical: at least annually, and whenever a privacy impact assessment is completed or updated] (PM-5(1)).
- Keep retired systems, with their retirement date, so the history supports audits.
- Record a system provided by an external service (for example a software-as-a-service application) as its own entry when the organization is responsible for authorizing its use.

| Field | What to record |
| --- | --- |
| ID | A unique, permanent system identifier |
| System name | The system's name, and any previous names |
| Description | What the system does and the mission or business function it supports |
| System owner | The role and organizational unit that owns the system |
| Authorizing official | The official who authorizes the system |
| Security categorization | The impact level for confidentiality, integrity and availability, and the overall level |
| Control baseline | The SP 800-53B baseline the system uses, with any tailoring noted in its security plan |
| Hosting | Where it runs: on premises, a named cloud service, or a provider |
| Processes PII | Yes or no; if yes, the privacy impact assessment reference |
| Interconnections | Other systems it exchanges information with, and the agreement reference (CA-3) |
| Authorization status | Authorized, in process or not authorized; decision date and termination date |
| Last assessment | Date of the last control assessment |
| Security plan | Where the system security plan is kept |
| Operational status | Planned, under development, operational, undergoing significant change, or retired |

## Register

| ID | System name | Description | System owner | Authorizing official | Security categorization | Control baseline | Hosting | Processes PII | Interconnections | Authorization status | Last assessment | Security plan | Operational status |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: name] | [Fill in: description] | [Fill in: owner] | [Fill in: official] | [Fill in: for example Moderate] | [Fill in: for example Moderate] | [Fill in: hosting] | [Fill in: yes or no] | [Fill in: systems] | [Fill in: status and dates] | [Fill in: date] | [Fill in: location] | [Fill in: status] |

### Federal systems

The Paperwork Reduction Act requires each agency head to maintain an inventory of major information systems, updated at least annually ([44 U.S.C. § 3505(c)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3505&num=0&edition=prelim)). Security categorization follows FIPS 199.

- The register shall mark each major information system and shall be updated at least annually. (PM-5)