CM-8(9): Assignment Of Components To Systems

CSF v1.1 References:


(Not part of any baseline)

Next Version:

Control Statement

The organization:

  1. Assigns [Assignment: organization-defined acquired information system components] to an information system; and
  2. Receives an acknowledgement from the information system owner of this assignment.

Supplemental Guidance

Organizations determine the criteria for or types of information system components (e.g., microprocessors, motherboards, software, programmable logic controllers, and network devices) that are subject to this control enhancement.