AM.4.226 Employ a capability to discover and identify systems with specific component attributes (e.g., firmware level, OS type) within your inventory.

CMMC Practice AM.4.226: Employ a capability to discover and identify systems with specific component attributes (e.g., firmware level, OS type) within your inventory.

Links to Publicly Available Resources

CMMC CLARIFICATION (Ref CMMC – Appendix B)

One purpose an organization might have in determining the component attributes is to identify and locate specific systems in the event a vulnerability is discovered in the hardware or software installed so patches can be rapidly deployed to these systems or have the systems isolated from the network. For small organizations or small enclaves, this might be achieved with manual processes. Automation is expected as scale increases in order to achieve results in an operational meaningful timeframe.