[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcm-8":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cm-8","CM-8","System Component Inventory",173,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must develop and maintain an inventory of system components that is accurate, complete, at the right level of detail for tracking and reporting, and reviewed and updated at a defined frequency.\n\n**In practice.** Doing this well means combining automated discovery from network scans, endpoint agents, cloud APIs and identity systems into one inventory with owners and criticality assigned. Auditors expect the inventory itself, evidence of how it is kept current and reconciliation between sources. This is the foundation of CIS Controls 1 and 2 and ISO\u002FIEC 27001 asset inventory.\n\n**Common gaps.** Inventories are often spreadsheets updated once a year, missing cloud, SaaS and shadow IT. Without owners and criticality, the inventory cannot support patching or incident response.","a. Develop and document an inventory of system components that:\n    1. Accurately reflects the system;\n    2. Includes all components within the system;\n    3. Does not include duplicate accounting of components or components assigned to any other system;\n    4. Is at the level of granularity deemed necessary for tracking and reporting; and\n    5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information] ; and\n  b. Review and update the system component inventory [Assignment: organization-defined frequency].\nDiscussion: System components are discrete, identifiable information technology assets that include hardware, software, and firmware. Organizations may choose to implement centralized system component inventories that include components from all organizational systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information, and for networked components, the machine names and network addresses across all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include date of receipt, cost, model, serial number, manufacturer, supplier information, component type, and physical location.\n\nPreventing duplicate accounting of system components addresses the lack of accountability that occurs when component ownership and system association is not known, especially in large or complex connected systems. Effective prevention of duplicate accounting of system components necessitates use of a unique identifier for each component. For software inventory, centrally managed software that is accessed via other systems is addressed as a component of the system on which it is installed and managed. Software installed on multiple organizational systems and managed at the system level is addressed for each individual system and may appear more than once in a centralized component inventory, necessitating a system association for each software instance in the centralized inventory to avoid duplicate accounting of components. Scanning systems implementing multiple network protocols (e.g., IPv4 and IPv6) can result in duplicate components being identified in different address spaces. The implementation of [CM-8(7)](#cm-8.7) can help to eliminate duplicate accounting of components.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"cisa-flags-four-actively-exploited-vulnerabilities-requiring-immediate-patching","CISA Flags Four Actively Exploited Vulnerabilities Requiring Immediate Patching","2026-10-14T22:21:22.354+00:00",{"slug":25,"title":26,"published_at":27},"unpatched-collabora-code-app-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora CODE App Lets Attackers Backdoor Nextcloud Servers","2026-10-14T20:20:54.985+00:00",{"slug":29,"title":30,"published_at":31},"shadow-ai-on-endpoints-creates-hidden-risk-and-data-exposure","Shadow AI on Endpoints Creates Hidden Risk and Data Exposure","2026-10-13T12:22:02.053+00:00",{"slug":33,"title":34,"published_at":35},"unsupported-windows-devices-lose-security-updates-in-2027","Unsupported Windows Devices Lose Security Updates in 2027","2026-10-09T12:22:29.662+00:00",{"slug":37,"title":38,"published_at":39},"cisco-patches-12-critical-flaws-across-major-product-lines","Cisco Patches 12+ Critical Flaws Across Major Product Lines","2026-10-08T16:20:36.276+00:00",{"slug":41,"title":42,"published_at":43},"chrome-155-patches-247-flaws-including-4-critical-use-after-free-bugs","Chrome 155 Patches 247 Flaws — Including 4 Critical Use-After-Free Bugs","2026-10-07T12:20:41.133+00:00",{"slug":45,"title":46,"published_at":47},"android-october-2026-patches-fix-25-flaws-including-critical-privilege-escalation","Android October 2026 Patches Fix 25 Flaws Including Critical Privilege Escalation","2026-10-07T08:20:52.719+00:00",{"slug":49,"title":50,"published_at":51},"hitachi-energy-soi-rce-flaw-exposes-critical-infrastructure-via-outdated-apache-activemq","Hitachi Energy SOI RCE Flaw Exposes Critical Infrastructure via Outdated Apache ActiveMQ","2026-10-06T18:22:47.029+00:00",{"slug":53,"title":54,"published_at":55},"thousands-of-unvetted-public-mcp-servers-expose-ai-supply-chain-risks","Thousands of Unvetted Public MCP Servers Expose AI Supply Chain Risks","2026-10-06T12:21:49.607+00:00",{"slug":57,"title":58,"published_at":59},"johnson-controls-easyio-neo-controllers-expose-sensitive-data-via-unpatched-firmware","Johnson Controls EasyIO Neo Controllers Expose Sensitive Data via Unpatched Firmware","2026-10-01T19:20:39.364+00:00",{"slug":61,"title":62,"published_at":63},"crypto-hack-citrix-exploits-poisoned-placeholder-domain-highlight-multi-front-threat-week","Crypto Hack, Citrix Exploits & Poisoned Placeholder Domain Highlight Multi-Front Threat Week","2026-09-28T19:20:42.355+00:00",{"slug":65,"title":66,"published_at":67},"cisa-flags-actively-exploited-sharepoint-and-mikrotik-flaws-patch-now","CISA Flags Actively Exploited SharePoint and MikroTik Flaws — Patch Now","2026-09-25T20:22:49.507+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",137,{"slug":75,"name":76,"problem":77,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",121,{"slug":80,"name":81,"problem":82,"stories":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",49,{"slug":85,"name":86,"problem":87,"stories":88},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",25,{"slug":90,"name":91,"problem":92,"stories":93},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",19,{"slug":95,"name":96,"problem":97,"stories":98},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",13,[100,106,111,116,121,125,130,135],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",157,{"family":5,"item":107,"code":108,"title":109,"together":110},"si-2","SI-2","Flaw Remediation",147,{"family":101,"item":112,"code":113,"title":114,"together":115},"12","Control 12","Network Infrastructure Management",65,{"family":101,"item":117,"code":118,"title":119,"together":120},"2","Control 2","Inventory and Control of Software Assets",63,{"family":5,"item":122,"code":123,"title":124,"together":83},"ra-5","RA-5","Vulnerability Monitoring and Scanning",{"family":126,"item":127,"code":128,"title":128,"together":129},"itil","overview","ITIL",47,{"family":101,"item":131,"code":132,"title":133,"together":134},"1","Control 1","Inventory and Control of Enterprise Assets",44,{"family":136,"item":137,"code":138,"title":139,"together":140},"gdpr","32","Article 32","Security of processing",31]