CMMC CM-8 - System Component Inventory

🔑 AUDIT-GRADE EVIDENCE • Follows AICPA SOC 2 / HHS HIPAA / PCI QSA ROC / NIST 800-53A • Report tamper-evident via SHA-256 chain

1. CONTROL IDENTIFICATION

FrameworkCMMC 2.0 Level 2
Control IDCM-8
Control FamilyCM - Configuration Management
Control NameSystem Component Inventory
StatusPARTIALLY IMPLEMENTED
Assessment Date2026-04-19T03:34:43.008438+00:00
AssessorTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Environment ScopeAzure: Pay-As-You-Go (prod) (4f29d094-1079-44c9-acb0-4d73a7a2dd34)
Report ID3703d6f1a4daaa407d85ba781abcce5d78758b3f4ce24695f5e70c2f741084ed

2. REGULATORY TEXT

Develop and document an inventory of system components that accurately reflects the system.

Source: https://dodcio.defense.gov/CMMC/Model/

3. IMPLEMENTATION SPECIFICATIONS

Each implementation specification addressed separately per HIPAA ยง164.306(d) / NIST 800-53A assessment methodology.

CM-8 REQUIRED System Component Inventory PARTIALLY IMPLEMENTED

Develop and document an inventory of system components that accurately reflects the system.

Evidence: #A1, #A2

4. EVIDENCE ARTIFACTS

Summarized with counts + exceptions + drill-down. Raw data available on request per retention policy.

#A1 Configuration scan 2026-04-19T03:34:43.008438+00:00
Full enumeration of in-scope resources. Configuration state captured via Azure Resource Graph + live API queries.
Records: 142 Exceptions surfaced: 0 Sampling: full enumeration
#A2 Policy document review 2026-04-19T03:34:43.008438+00:00
Governing policy document identified, version and approval date verified.
Records: 1 Exceptions surfaced: 0 Sampling: policy artifact review
#A3 Operational evidence (90-day window) 2026-04-19T03:34:43.008438+00:00
Activity logs reviewed over 90-day window. Consistent with policy and control objective.
Records: 90 Exceptions surfaced: 0 Sampling: 90-day log window, AICPA AU-C 530

5. TESTING PROCEDURES & RESULTS

Test of Design (does the control exist?) + Test of Operating Effectiveness (does it work consistently?). Sampling per AICPA AU-C 530.

Test of Design DESIGN PASS
Sample size: n/a (policy review)

Policy documents align with control objective.

Test of Operating Effectiveness OPERATING PASS
Sample size: AICPA 25-sample of qualifying events over 90-day window

Sampled events comply with policy. No exceptions identified.

6. FINDINGS / EXCEPTIONS

Active findings: 1 · Accepted risks (exceptions): 0 · Total: 1

Click any finding to view detail, remediation, and record an exception (risk acceptance). Exceptions are retained in the report as part of the audit trail.

#8d0c43ede70e439f MEDIUM baseline-drift 3 resources drifted from approved Bicep baseline. ▾

7. MANAGEMENT RESPONSE

SOC 2 Type 2 and HITRUST assessors require management's written response to findings.

Management has reviewed 1 finding(s). Remediation in progress per plan. Quarterly review cadence confirmed.

8. AUDIT TRAIL

ScannerTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Scanner versionv2.0.1
Collection timestamp2026-04-19T03:34:43.008438+00:00
Retention2555 days (HIPAA 164.316(b)(2))
Report hash (SHA-256)3703d6f1a4daaa407d85ba781abcce5d78758b3f4ce24695f5e70c2f741084ed

9. CROSS-FRAMEWORK MAPPING

This same evidence is admissible for the following related controls. Scan once, satisfy multiple frameworks.