System Inventory template: The organization-wide register of its systems, each with an owner, categorization, authorization status and boundary, and whether it processes personally identifiable information, as SP 800-53 PM-5 and PM-5(1) require.
The organization-wide register of its systems, each with an owner, categorization, authorization status and boundary, and whether it processes personally identifiable information, as SP 800-53 PM-5 and PM-5(1) require.
Add a system when it is first planned, and before it is authorized or placed in operation (PM-5).
Update the register Fill in: the frequency at which to update the inventory of organizational systems Typical: quarterly, and whenever a system is authorized, significantly changed or retired (PM-5).
Mark each system that processes personally identifiable information, and review those entries with the Senior privacy officialFill in: the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information Typical: at least annually, and whenever a privacy impact assessment is completed or updated (PM-5(1)).
Keep retired systems, with their retirement date, so the history supports audits.
Record a system provided by an external service (for example a software-as-a-service application) as its own entry when the organization is responsible for authorizing its use.
Field
What to record
ID
A unique, permanent system identifier
System name
The system’s name, and any previous names
Description
What the system does and the mission or business function it supports
System owner
The role and organizational unit that owns the system
Authorizing official
The official who authorizes the system
Security categorization
The impact level for confidentiality, integrity and availability, and the overall level
Control baseline
The SP 800-53B baseline the system uses, with any tailoring noted in its security plan
Hosting
Where it runs: on premises, a named cloud service, or a provider
Processes PII
Yes or no; if yes, the privacy impact assessment reference
Interconnections
Other systems it exchanges information with, and the agreement reference (CA-3)
Authorization status
Authorized, in process or not authorized; decision date and termination date
Last assessment
Date of the last control assessment
Security plan
Where the system security plan is kept
Operational status
Planned, under development, operational, undergoing significant change, or retired
The Paperwork Reduction Act requires each agency head to maintain an inventory of major information systems, updated at least annually (44 U.S.C. § 3505(c)). Security categorization follows FIPS 199.
The register shall mark each major information system and shall be updated at least annually. (PM-5)
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.