NIST-CM-8 System Component Inventory

a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other system; 4. Is at the level of granularity deemed necessary for tracking and reporting; and 5. Includes the following information to achieve system component accountability: [Assignment: information] ; and b. Review and update the system component inventory [Assignment: frequency].

System components are discrete, identifiable information technology assets that include hardware, software, and firmware. Organizations may choose to implement centralized system component inventories that include components from all organizational systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information, and for networked components, the machine names and network addresses across all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include date of receipt, cost, model, serial number, manufacturer, supplier information, component type, and physical location. Preventing duplicate accounting of system components addresses the lack of accountability that occurs when component ownership and system association is not known, especially in large or complex connected systems. Effective prevention of duplicate accounting of system components necessitates use of a unique identifier for each component. For software inventory, centrally managed software that is accessed via other systems is addressed as a component of the system on which it is installed and managed. Software installed on multiple organizational systems and managed at the system level is addressed for each individual system and may appear more than once in a centralized component inventory, necessitating a system association for each software instance in the centralized inventory to avoid duplicate accounting of components. Scanning systems implementing multiple network protocols (e.g., IPv4 and IPv6) can result in duplicate components being identified in different address spaces. The implementation of [CM-8(7)](#cm-8.7) can help to eliminate duplicate accounting of components.

• T1011.001 Exfiltration Over Bluetooth • T1020.001 Traffic Duplication • T1021.001 Remote Desktop Protocol • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1046 Network Service Discovery • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.005 Scheduled Task • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.005 Visual Basic • T1059.007 JavaScript • T1059.010 AutoHotKey & AutoIT • T1068 Exploitation for Privilege Escalation • T1072 Software Deployment Tools • T1091 Replication Through Removable Media • T1092 Communication Through Removable Media • T1098.004 SSH Authorized Keys • T1119 Automated Collection • T1127 Trusted Developer Utilities Proxy Execution • T1127.001 MSBuild • T1127.002 ClickOnce • T1133 External Remote Services • T1137 Office Application Startup • T1137.001 Office Template Macros • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1195.003 Compromise Hardware Supply Chain • T1203 Exploitation for Client Execution • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.003 CMSTP • T1218.004 InstallUtil • T1218.005 Mshta • T1218.008 Odbcconf • T1218.009 Regsvcs/Regasm • T1218.012 Verclsid • T1218.013 Mavinject • T1218.014 MMC • T1218.015 Electron Applications • T1221 Template Injection • T1495 Firmware Corruption • T1505 Server Software Component • T1505.001 SQL Stored Procedures • T1505.002 Transport Agent • T1505.004 IIS Components • T1530 Data from Cloud Storage • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1546.002 Screensaver • T1546.006 LC_LOAD_DYLIB Addition • T1546.014 Emond • T1547.007 Re-opened Applications • T1548 Abuse Elevation Control Mechanism • T1548.004 Elevated Execution with Prompt • T1548.006 TCC Manipulation • T1553 Subvert Trust Controls • T1553.006 Code Signing Policy Modification • T1556.009 Conditional Access Policies • T1557 Adversary-in-the-Middle • T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay • T1557.002 ARP Cache Poisoning • T1557.003 DHCP Spoofing • T1559 Inter-Process Communication • T1559.002 Dynamic Data Exchange • T1563 Remote Service Session Hijacking • T1563.001 SSH Hijacking • T1563.002 RDP Hijacking • T1564.006 Run Virtual Instance • T1564.007 VBA Stomping • T1565 Data Manipulation • T1565.001 Stored Data Manipulation • T1565.002 Transmitted Data Manipulation • T1574 Hijack Execution Flow • T1574.004 Dylib Hijacking • T1574.007 Path Interception by PATH Environment Variable • T1574.008 Path Interception by Search Order Hijacking • T1574.009 Path Interception by Unquoted Path • T1593.003 Code Repositories • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump • T1622 Debugger Evasion