Req 2.4 requires maintaining an inventory of system components. What should the inventory include?

Req 2.4 requires maintaining an inventory of system components. What should the inventory include?

• A. A list of hardware and software components with a description of function/use
• B. Only hardware inventory
• C. Only software inventory
• D. No inventory required

Answer: (A)

Maintaining an up-to-date inventory means tracking both hardware and software components and detailing what each one does. By listing hardware and software with a description of function or use, you gain a clear view of what assets exist, their roles in the environment, and how they are used. This visibility supports tasks like patching, configuration management, and risk assessment, because you know exactly which items are present, where they are, and what they’re responsible for. Limiting the inventory to only hardware or only software misses part of the picture and leaves gaps in security management. Skipping the inventory entirely defeats the purpose of being able to manage and secure system components.

Maintaining an up-to-date inventory means tracking both hardware and software components and detailing what each one does. By listing hardware and software with a description of function or use, you gain a clear view of what assets exist, their roles in the environment, and how they are used. This visibility supports tasks like patching, configuration management, and risk assessment, because you know exactly which items are present, where they are, and what they’re responsible for. Limiting the inventory to only hardware or only software misses part of the picture and leaves gaps in security management. Skipping the inventory entirely defeats the purpose of being able to manage and secure system components.