NIST SP 800-53 Rev. 5 · Configuration Management
CM-8 on AWS
Device active in the estate but absent from the inventory — a published SQL (Athena) + Lambda query you can run against Amazon Athena over EC2 inventory and CloudTrail, with the evidence it needs, the settings you decide, and what a result does and does not establish.
Why this matters
A device operating on the network that appears on no inventory
An organization cannot protect what it does not know it has. Devices arrive without going through any process — a contractor's laptop, a replacement machine, equipment from an acquired business — and they receive no updates, no monitoring, and no attention, because as far as every system of record is concerned they do not exist.
Why this check earns its place. It works from evidence of actual activity rather than from a scan, so it finds devices that are genuinely in use rather than addresses that happen to respond. New devices are given a grace period, so ordinary onboarding does not generate findings.
- What it reads
- Evidence of devices actually being used, compared against the organization's own inventory.
- What it reports
- Devices that have been active for longer than the registration period allows and appear on no inventory.
See related public disclosures on the Signals page →
What this finds
A device generated authentication or platform telemetry, has been doing so for longer than the registration grace period, and does not appear in the supplied asset inventory.
The requirement
The organization must develop and maintain an inventory of system components that accurately reflects the system, is at the level of granularity deemed necessary for tracking and reporting, and is reviewed and updated at an organization-defined frequency.
NIST SP 800-53 Rev. 5 — CM-8 (System Component Inventory).
NIST requires the inventory to be accurate. It does not say what counts as a component, how quickly a new device must be registered, or which populations are exempt. This pack finds devices that are demonstrably active — they authenticated or generated telemetry — and are not in the inventory you supplied. The registration grace period and the exempt populations are yours to define.
How this maps to the CISA performance goals
The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:
- 3.R — Prohibit connection of unauthorized devices
The goal is preventing unauthorized devices from connecting; the pack finds devices demonstrably active in the estate that the inventory does not list. - 2.A — Manage organizational assets
Managing organizational assets requires the inventory to be accurate. This pack tests that accuracy directly, from the opposite direction: it finds what the inventory is missing.
See the full coverage map, including the goals no query can answer →
Evidence this query needs
Asset inventory asset_inventory.csv
Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against.
Minimum fields: asset_id, environment, criticality
Three fields let you scope the checks. The backup_required and logging_required flags are what make the absence checks possible — without them the tool cannot tell an asset that should be backed up from one that should not.
The query
Published as cm-8-unmanaged-devices.aws.sql. Reads ec2_instance_inventory (Config export), asset_inventory (supplied). Requires: athena:StartQueryExecution; glue:GetTable; s3:GetObject.
Before this returns anything,
ec2_instance_inventory (Config export) has to be reaching Amazon Athena over EC2 inventory and CloudTrail, and asset_inventory (supplied) has to be landed there. If not, the query reports nothing found — which looks
exactly like nothing wrong. What has to be switched on first →
-- CM-8 -- instances running in the account that the inventory does not list
-- Requires the asset_inventory contract registered as an Athena table.
SELECT
e.instance_id,
e.private_ip_address,
e.instance_state,
e.launch_time,
date_diff('day', e.launch_time, current_timestamp) AS days_unregistered,
'ec2 inventory' AS signal
FROM ec2_instance_inventory e
LEFT JOIN asset_inventory a
ON lower(e.instance_id) = lower(a.asset_id)
WHERE e.instance_state = 'running'
AND a.asset_id IS NULL
-- a newly launched instance is a registration backlog, not a finding
AND e.launch_time < current_timestamp - interval '7' day
ORDER BY days_unregistered DESC;Open this pack on AWS to adjust the settings and download it →
The interactive version opens on AWS — the platform on this page — even if your environment profile does not list it.
Settings you decide
NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.
- Registration grace period (days) (default 7)
- An instance is only reported once it has been running this many days without appearing in the inventory.
- Exclude specific instances (optional)
- Paste instance ids to exempt, one per line.
Running it continuously
EventBridge Scheduler → Lambda → Security Hub
Schedule: EventBridge Scheduler, rate(12 hours)
Compute: Lambda (Python 3.12), 60s timeout
Step 1: Start Athena query, poll for completion
Step 2: Build an ASFF finding per returned row
Step 3: BatchImportFindings -> AWS Security Hub
Severity label: MEDIUM
Workflow status: NEW
RelatedRequirements: NIST.800-53.r5 CM-8
Idempotency: Id = sha256(instance_id)Keyed on the instance id alone, so a long-running unregistered instance stays one finding rather than accumulating a new one every twelve hours.
What a result does not prove
An unregistered device is not evidence of an intrusion, and this is the pack most likely to report a records problem rather than a security one. Identifier mismatches between telemetry and inventory produce the same result as a genuinely unknown device, which is why the review tier is automated-with-review rather than automated.
Validation status for this platform: Not tenant-validated. Structure, query generation, and preflight are covered by the project's automated test suites. This pack has not been executed against a live tenant, account, or index. Validate it in a non-production scope before relying on any result.
Before you act on a result
- Is the inventory export complete and current, or does it cover only part of the estate?
- Does the device use a different identifier in telemetry than in the inventory — a hostname against an asset tag, for example?
- Is this an exempt population, such as a guest network or an ephemeral build agent?
- Was the device registered under a name that has since changed?
- If it is genuinely unmanaged, who owns it and what does it have access to?
Common questions
- How do I check for device active in the estate but absent from the inventory in AWS?
- Run the published SQL (Athena) + Lambda query on this page against Amazon Athena over EC2 inventory and CloudTrail. It reads ec2_instance_inventory (Config export), asset_inventory (supplied) and reports: A device generated authentication or platform telemetry, has been doing so for longer than the registration grace period, and does not appear in the supplied asset inventory.
- What permissions are needed to run this AWS query?
- athena:StartQueryExecution; glue:GetTable; s3:GetObject.
- What evidence does CM-8 need that AWS cannot produce?
- Asset inventory (asset_inventory.csv). Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against. At minimum it must carry: asset_id, environment, criticality.
- Does a result from this query mean the control has failed?
- An unregistered device is not evidence of an intrusion, and this is the pack most likely to report a records problem rather than a security one. Identifier mismatches between telemetry and inventory produce the same result as a genuinely unknown device, which is why the review tier is automated-with-review rather than automated.
Terms used on this page
- NIST SP 800-53the U.S. federal catalogue of security requirements
- The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
- CISACybersecurity and Infrastructure Security Agency
- The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
- CPGCross-Sector Cybersecurity Performance Goals
- A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
- not tenant-validatednever executed against real data
- The check has passed the project's automated tests for structure and syntax, but has never been run against real data anywhere. Test it in a safe scope before relying on any result.