Control statement
Develop and update [Organization-defined: frequency] an inventory of organizational systems.
Discussion
[OMB A-130](#27847491-5ce1-4f6a-a1e4-9e483782f0ef) provides guidance on developing systems inventories and associated reporting requirements. System inventory refers to an organization-wide inventory of systems, not system components as described in [CM-8](#cm-8).
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use System Inventory as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to enterprise program governance, accountability, resources, metrics, and organization-wide risk decisions.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- program charters and policies
- governance meeting records
- risk and performance metrics
- resource and responsibility assignments
Common failure patterns
- program metrics count activity instead of outcomes
- system-level risks never reach enterprise governance
- responsibilities assigned without authority or resources
- privacy and security managed in separate silos
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PM-05[01]an inventory of organizational systems is developed;
- PM-05[02]the inventory of organizational systems is updated [Organization-defined: frequency].
Examine
- Information security program plan
- system inventory
- procedures addressing system inventory development and maintenance
- OMB FISMA reporting guidance
- other relevant documents or records
Interview
- Organizational personnel with information security program planning and plan implementation responsibilities
- organizational personnel responsible for developing and maintaining the system inventory
- organizational personnel with information security responsibilities
Test
- Organizational processes for system inventory development and maintenance
- mechanisms supporting the system inventory
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
PM-5(1) — Inventory of Personally Identifiable Information
Establish, maintain, and update [Organization-defined: frequency] an inventory of all systems, applications, and projects that process personally identifiable information.
Official discussion
An inventory of systems, applications, and projects that process personally identifiable information supports the mapping of data actions, providing individuals with privacy notices, maintaining accurate personally identifiable information, and limiting the processing of personally identifiable information when such information is not needed for operational purposes. Organizations may use this inventory to ensure that systems only process the personally identifiable information for authorized purposes and that this processing is still relevant and necessary for the purpose specified therein.
Organization-defined parameters (1)
Assessment objectives and methods
- PM-05(01)[01]an inventory of all systems, applications, and projects that process personally identifiable information is established;
- PM-05(01)[02]an inventory of all systems, applications, and projects that process personally identifiable information is maintained;
- PM-05(01)[03]an inventory of all systems, applications, and projects that process personally identifiable information is updated [Organization-defined: frequency].
Examine
- Procedures addressing system inventory development, maintenance, and updates
- OMB FISMA reporting guidance
- privacy program plan
- information security program plan
- personally identifiable information processing policy
- system inventory
- personally identifiable information inventory
- data mapping documentation
- other relevant documents or records
Interview
- Organizational personnel with privacy program planning and plan implementation responsibilities
- organizational personnel responsible for developing and maintaining the system inventory
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for system inventory development, maintenance, and updates
- mechanisms supporting the system inventory
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.