03.04.10System Component Inventory in Rev. 3

New in Revision 3 — no Revision 2 equivalent. Nothing in NIST SP 800-171 Rev. 2 maps onto this number, so it has no Rev. 2 page and no side-by-side; the Rev. 3 text is below in full. It carries organization-defined parameters.

New
Rev. 3 · not adopted
1 ODP
Configuration Management

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

The requirement

Rev. 3 · not adopted 03.04.10 System Component Inventory

a. Develop and document an inventory of system components.

b. Review and update the system component inventory [Assignment: organization-defined frequency].

c. Update the system component inventory as part of installations, removals, and system updates.

NIST SP 800-171 Rev. 3, verbatim, with organization-defined blanks highlighted. Rev. 2 has no counterpart to place beside it.

Determination statements

What an assessor would check under NIST SP 800-171A Rev. 3. 6 statements, each one answered yes or no.

03.04.10.a an inventory of system components is developed and documented.
03.04.10.b[01] the system component inventory is reviewed <A.03.04.10.ODP[01]: frequency>.
03.04.10.b[02] the system component inventory is updated <A.03.04.10.ODP[01]: frequency>.
03.04.10.c[01] the system component inventory is updated as part of component installations.
03.04.10.c[02] the system component inventory is updated as part of component removals.
03.04.10.c[03] the system component inventory is updated as part of system updates.

NIST SP 800-171A Rev. 3, verbatim.

Organization-defined parameters

Blanks the organization fills in. Defining each value is itself a determination in 800-171A Rev. 3.

A.03.04.10.ODP[01] the frequency at which to review and update the system component inventory is defined.

What NIST says

New security requirement based on CM-08 and CM-08(01) (SP 800-53, Revision 5).
Added new ODP: frequency to review and update system component inventory

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “New requirement”. At adoption, Bedrock files this under “New”.

NIST's Rev. 3 discussion for 03.04.10

System components are discrete, identifiable assets (i.e., hardware, software, and firmware elements) that compose a system. Organizations may implement centralized system component inventories that include components from all systems. In such situations, organizations ensure that the inventories include the system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, software license information, hardware inventory specifications, and — for networked components — the machine names and network addresses for all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include component type, physical location, date of receipt, manufacturer, cost, model, serial number, and supplier information.

Configuration Management in Rev. 3

The active CM requirements in Rev. 3. Those with a Rev. 2 predecessor link to that comparison; those marked new have their own page.

All Configuration Management requirements in Rev. 2

What this means for you now

Nothing. Until a class deviation or a published rule adopts Rev. 3, no assessor asks about 03.04.10 and SPRS has no score for it. If you already do what it describes, note where the evidence lives and what value you use for the parameters above; that costs nothing and answers the question later.

Bedrock CMMC carries the Rev. 3 catalog beside your Rev. 2 package, so the day adoption lands the new requirements are a to-do list, not a surprise.

Where this page's facts come from

Rev. 3 03.04.10 text, determination statements, parameters, class and note: bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]