---

id: "CM-08(06)" title: "Assessed Configurations and Approved Deviations" family: "CM" family_name: "Configuration Management" sort_id: "cm-08.06" priority: "P1" implementation_level: "organization" parent: "CM-08" enhancement: True

---

Statement

Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.

Guidance

Assessed configurations and approved deviations focus on configuration settings established by organizations for system components, the specific components that have been assessed to determine compliance with the required configuration settings, and any approved deviations from established configuration settings.

Assessment Objective: assessed component configurations are included in the system component inventory;

Assessment Objective: any approved deviations to current deployed configurations are included in the system component inventory.

Configuration management policy

procedures addressing system component inventory

configuration management plan

system security plan

system design documentation

system component inventory

system configuration settings and associated documentation

change control records

system security plan

other relevant documents or records

Organizational personnel with component inventory management responsibilities

organizational personnel with assessment responsibilities

organizational personnel with information security responsibilities

system/network administrators

Organizational processes for managing the system component inventory

mechanisms supporting and/or implementing system component inventory