Unknown imaging PC on the clinical VLAN
Discovery finds a Windows box not in the CMDB storing local studies. It is inventoried, encrypted, patched, or removed — closing a blind spot.
Information System Component Inventory
High Risk
Moderate
Medium Cost
CM-8 requires developing and documenting an inventory of system components that accurately reflects the current system, includes all components within the authorization boundary, is at the level of granularity deemed necessary, and is reviewed/updated for accuracy. You cannot protect, patch, or risk-assess ePHI systems you do not know exist.
Control Objective
Maintain an accurate, current inventory of hardware, software, and cloud components that create, receive, maintain, or transmit ePHI — or support those systems.
Implementation Guidance
- Define inventory scope: endpoints, servers, network gear, biomed with IP, cloud accounts, SaaS with ePHI, and major software agents.
- Record owner, location/site, data class (ePHI yes/no), baseline ID, and lifecycle status.
- Discover continuously via agents, network scans, and cloud APIs — reconcile to the CMDB.
- Review inventory accuracy on a defined cadence; investigate rogue devices.
- Tie onboarding/offboarding of assets to procurement and MP-6 disposal.
- Include shadow IT SaaS found via CASB/finance reviews.
- Use inventory as the scope source for RA-3, RA-5, and CP-2.
- Restrict who can modify inventory authoritative records.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
SaaS form tool collecting patient data
Marketing buys a form SaaS on a credit card. CM-8 + procurement review adds it to inventory, triggers BAA and security review.
Laptop refresh without CMDB update
Old devices linger with ePHI offline. Inventory reconciliation catches missing return/sanitization tickets (MP-6).
Best Practices
- Continuous discovery + human ownership fields.
- Mark ePHI-impacting assets clearly.
- Reconcile monthly for critical sites.
- Link assets to baselines and patch status.
- Include cloud and SaaS, not only servers.
- Feed inventory into risk and contingency docs.
Common Gaps & Violations
- Spreadsheet inventory years stale.
- Cloud accounts and SaaS omitted.
- Biomed network devices invisible.
- No owner field — orphan assets.
- Discovery tools run but never reconciled.
Required Documentation
- Asset inventory procedure and data dictionary
- Current inventory export / CMDB evidence
- Discovery tool coverage maps
- Reconciliation reports
- Rogue device handling procedure
How to Test & Validate
- Pick a random clinic room device; confirm it appears in inventory.
- Compare discovery results to CMDB; sample mismatches.
- Verify ePHI flag accuracy on a sample of assets.
- Confirm disposed assets are retired in inventory.
- Review cloud account inventory completeness.
Audit Considerations
Assessors compare floor reality to inventory lists. Missing assets undermine every other control claim.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(1) Risk Analysis — inventories underpin thorough assessment of where ePHI resides.
- 164.310(d) Device and Media Controls — tracking hardware/media movements depends on knowing components.
- 164.308(a)(8) Evaluation — evaluations need a defined system boundary/inventory.
- 164.316 Documentation — retain inventory-related documentation as part of the security program.
Compliance Tips
- Make 'update CMDB' a required field on install tickets.
- Quarterly walk a clinic with inventory in hand.
- Sync SaaS discovery with AP vendor spend reports.
Frequently Asked Questions
How detailed must the inventory be?
Enough to manage risk — typically identity, owner, location, ePHI impact, and software/hardware type. Increase granularity for critical systems.
Are cloud VMs and SaaS 'components'?
Yes. Include them in the authorization boundary inventory.
How does CM-8 relate to CM-2?
Inventory lists what you have; baselines define how each class should be built.
References & Resources
- NIST SP 800-53 Rev. 5 — CM-8
- Related controls: CM-2, RA-3, RA-5, MP-6, CP-2
Related Guidelines
Related controls that commonly accompany CM-8.
Need Help Implementing CM-8?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.