ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
2
FedRAMP® System Security Plan (SSP)
Appendix M: FedRAMP Integrated Inventory Workbook Template
3
4
5
Overview:
6
When completed, FedRAMP will accept this inventory workbook as the inventory information required by the following:
7
 - System Security Plan
- Security Assessment Plan
- Security Assessment Report
- Information System Contingency Plan
- Monthly Continuous Monitoring
8
Where the above documents require an inventory, include or refer to this document.
9
Note: This document replaces the separate inventory templates or tabs that existed in the above documents.
10
Instructions:
11
1. The cloud service provider (CSP) must use this inventory template to capture inventory items for all components of the cloud service offering (CSO) as part of preparing for a Readiness Assessment or initial authorization of a CSO for a FedRAMP authorization.
2. This inventory format must be used for assessment testing efforts by an independent assessor (IA).
3. Once a CSO is in the Continuous Monitoring phase of its lifecycle, the CSP will continue to use this template to capture and submit inventory for monthly Continuous Monitoring efforts. Be sure to "save-as" the inventory to keep month-to-month submissions of the inventory. The CSP may either include the inventory as a tab within the monthly POA&M worksheet or may just keep the inventory as a separate worksheet.
4. Optional fields should be left blank indicating no data instead of inserting "n/a,"" N/A," "na" or other variants.

The templates referenced in these instructions are available on the FedRAMP Documents and Templates web page.
12
FedRAMP requires that at each security assessment and for each monthly continuous monitoring submission, the CSO inventory aligns with the scan targets. FedRAMP requires tracking in the Integrated Inventory Workbook (IIW) by container asset class, meaning the container image in the container registry, not the runtime containers. If an assessment or continuous monitoring submission is submitted and the FedRAMP review of the raw scan results does not validate the IIW, the package will be rejected and analysis of the deficiencies will be provided.

Here is what FedRAMP requires for the Inventory:
1. For any scanned inventory item that is not a container, we expect that Column A, the Unique Asset Identifier (most likely hostname, IP, or URL for web) can be verified or found within the scans provided by the CSP. Column B is the IP address. This means that for some inventory items Column A and Column B may both be the IP address(es) for the specific component.
2. For containers, there needs to be an identifiable string in the scans that maps back to the image name/version number in use as identified in the container registry. That is normally the repository/image/version# or can be represented as a checksum. This is what should be then put into the Inventory (IIW), POA&M, and on any Deviations submitted.
a. In Column A, the cell must contain the Repository/Image Name/Version# as the Unique Asset Identifier.
b. In Column B, the cell must contain the individual hash of the container in the registry for each of the containers in production that align to that Image Name/Version.
13
Sensitive and Proprietary
14
15
info@fedramp.gov
fedramp.gov
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100