Control index

94/409 fetchable across every Rev5 baseline

- orphanCM-01 — Policy and Procedures — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-02 — Baseline Configuration
- recipe · 1 recipeCM-02 (02) — Automation Support for Accuracy and Currency
- KSI onlyCM-02 (03) — Retention of Previous Configurations
- KSI onlyCM-02 (07) — Configure Systems and Components for High-risk Areas
- recipe · 1 recipeCM-03 — Configuration Change Control
- orphanCM-03 (01) — Automated Documentation, Notification, and Prohibition of Changes — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyCM-03 (02) — Testing, Validation, and Documentation of Changes
- recipe · 1 recipeCM-03 (04) — Security and Privacy Representatives
- orphanCM-03 (06) — Cryptography Management — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-04 — Impact Analyses — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-04 (01) — Separate Test Environments — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-04 (02) — Verification of Controls
- recipe · 1 recipeCM-05 — Access Restrictions for Change
- orphanCM-05 (01) — Automated Access Enforcement and Audit Records — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-05 (05) — Privilege Limitation for Production and Operation — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-06 — Configuration Settings
- orphanCM-06 (01) — Automated Management, Application, and Verification — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-06 (02) — Respond to Unauthorized Changes — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-07 — Least Functionality
- recipe · 1 recipeCM-07 (01) — Periodic Review
- KSI onlyCM-07 (02) — Prevent Program Execution
- KSI onlyCM-07 (05) — Authorized Software — Allow-by-exception
- recipe · 1 recipeCM-08 — System Component Inventory
- recipe · 1 recipeCM-08 (01) — Updates During Installation and Removal
- orphanCM-08 (02) — Automated Maintenance — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-08 (03) — Automated Unauthorized Component Detection
- orphanCM-08 (04) — Accountability Information — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyCM-09 — Configuration Management Plan
- orphanCM-10 — Software Usage Restrictions — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-11 — User-installed Software — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-12 — Information Location
- recipe · 1 recipeCM-12 (01) — Automated Tools to Support Information Location
- orphanCM-14 — Signed Components — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- All CM in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

CM-08 (01) Updates During Installation and Removalcm-8.1

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches CM-08 (01), and none is rated full — the output narrows the question, a human judgement closes it.

AWS Config · AWS Systems Manager Inventory1 recipe · 5 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for CM-08 (01). This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialThe machine-maintained component inventory — Config's recorder status and discovered-resource counts proving supported resources are tracked continuously and the list stays current without anyone editing a spreadsheet, plus Systems Manager Inventory's node and installed-application metadata for what runs inside themdailycli
config-asset-inventoryAWS Config · AWS Systems Manager Inventory
This proves the inventory is machine-maintained and current (CM-08.01, and the automated-currency half of CM-02.02) — it does not prove the inventory is complete. Config sees only supported resource types, only in the regions and accounts where a recorder runs, and only within the recording group you configured; unsupported types, an un-recorded region, on-premises hosts, SaaS components and in-container software are invisible here and need their own source. SSM Inventory covers only managed nodes with a running agent and an inventory association, collects no more often than every 30 minutes, and the console's Inventory cards hide stopped and terminated nodes even though the API still returns them. The accountability attributes CM-08 asks for — system owner, function, criticality — live in your tags or CMDB, not in a resource count, so join them before calling this an inventory. Substitute your real instance id. Detecting unauthorized components (CM-08.03) is a different question; the prohibited-software half is in the least-functionality recipe.

What NIST requires of CM-08 (01)

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

Update the inventory of system components as part of component installations, removals, and system updates.

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baseline

Class C readiness

Class Dour reading: Rev5 High

in baseline

Class D readiness

KSI indicators reaching this control (2)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act