# System Inventory

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/system-inventory/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| Organization | Maintained by | Last updated | Updated by |
| --- | --- | --- | --- |
| [Organization name] | [Chief Information Security Officer] | [Fill in: date] | [Fill in: name and title] |

## How to use this register

- Add a system when it is first planned, and before it is authorized or placed in operation (PM-5).
- Update the register [Fill in: the frequency at which to update the inventory of organizational systems. Typical: quarterly, and whenever a system is authorized, significantly changed or retired] (PM-5).
- Mark each system that processes personally identifiable information, and review those entries with the [Senior privacy official] [Fill in: the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information. Typical: at least annually, and whenever a privacy impact assessment is completed or updated] (PM-5(1)).
- Keep retired systems, with their retirement date, so the history supports audits.
- Record a system provided by an external service (for example a software-as-a-service application) as its own entry when the organization is responsible for authorizing its use.

| Field | What to record |
| --- | --- |
| ID | A unique, permanent system identifier |
| System name | The system's name, and any previous names |
| Description | What the system does and the mission or business function it supports |
| System owner | The role and organizational unit that owns the system |
| Authorizing official | The official who authorizes the system |
| Security categorization | The impact level for confidentiality, integrity and availability, and the overall level |
| Control baseline | The SP 800-53B baseline the system uses, with any tailoring noted in its security plan |
| Hosting | Where it runs: on premises, a named cloud service, or a provider |
| Processes PII | Yes or no; if yes, the privacy impact assessment reference |
| Interconnections | Other systems it exchanges information with, and the agreement reference (CA-3) |
| Authorization status | Authorized, in process or not authorized; decision date and termination date |
| Last assessment | Date of the last control assessment |
| Security plan | Where the system security plan is kept |
| Operational status | Planned, under development, operational, undergoing significant change, or retired |

## Register

| ID | System name | Description | System owner | Authorizing official | Security categorization | Control baseline | Hosting | Processes PII | Interconnections | Authorization status | Last assessment | Security plan | Operational status |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: name] | [Fill in: description] | [Fill in: owner] | [Fill in: official] | [Fill in: for example Moderate] | [Fill in: for example Moderate] | [Fill in: hosting] | [Fill in: yes or no] | [Fill in: systems] | [Fill in: status and dates] | [Fill in: date] | [Fill in: location] | [Fill in: status] |

### Federal systems

The Paperwork Reduction Act requires each agency head to maintain an inventory of major information systems, updated at least annually ([44 U.S.C. § 3505(c)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3505&num=0&edition=prelim)). Security categorization follows FIPS 199.

- The register shall mark each major information system and shall be updated at least annually. (PM-5)