Meeting FAR 52.204-21 and CMMC 2.0 Level 1 Control IA.L1-B.1.V starts with a simple but often-neglected baseline: an accurate, actionable inventory of users and devices. An inventory is not a static spreadsheet — it's the authoritative source that ties people, endpoints, and access decisions together so you can prove you identify who and what is connecting to systems that handle Controlled Unclassified Information (CUI) or contractor-controlled information.
Why an actionable inventory matters for Compliance Framework practice
For the Compliance Framework and the related Practice, IA.L1-B.1.V requires that organizations identify users and devices before allowing access. That means the inventory must include identity linkage (which user owns or uses each device), device attributes (OS, serial/MAC, IP, last-seen timestamp), and status (managed/unmanaged, enrolled/not enrolled). This inventory becomes the gatekeeper for access control, MFA enrollment, and incident response — auditors will expect to see evidence that each user/device was identified and managed in line with policy.
Core fields and data model (technical specifics)
Build your inventory schema to capture at minimum: unique asset ID, hostname, MAC address, IP addresses, operating system and version, patch level, device owner (username and employee ID), authentication method (AD/LDAP/Azure AD/SAML), enrollment status (MDM/EDR/NAC), physical or logical location, last-seen timestamp, and whether the device stores or accesses CUI. For users capture: username, full name, employee/contractor flag, department, role, privileged status, MFA enrollment, and account creation/termination dates. Store this in a CMDB, identity directory with extension attributes, or a well-structured database/CSV that integrates with your IAM and ITSM systems.
Practical implementation steps for a small business
Start small and iterate. Example implementation for a 25-employee small business with remote users: 1) Export AD or Azure AD user list (PowerShell: Get-ADUser -Properties * or AzureAD Graph queries) and collect device lists from Intune (Get-IntuneDevice) or Jamf for macOS. 2) Run an initial network discovery (nmap -sn 192.168.1.0/24; or use a lightweight scanner like Advanced IP Scanner) to identify unmanaged endpoints. 3) Enroll corporate devices into an MDM (Intune/Microsoft Endpoint Manager or Jamf) and install an EDR agent for continuous reporting. 4) Reconcile the network-discovered devices with AD/Azure AD entries and mark exceptions for personal devices or IoT. 5) Maintain a simple reconciliation process in an ITSM ticket for every onboarding/offboarding action — HR creates tickets that trigger account/device provisioning and recording in the inventory.
Tooling and automation—what to deploy
Use a combination of lightweight automation and manual verification. Recommended stack: identity store (Active Directory / Azure AD), MDM (Intune/Jamf), EDR (CrowdStrike, Defender for Endpoint), NAC (Cisco ISE, open-source alternatives), and a CMDB or spreadsheet if you're very small. Automate daily queries: PowerShell scripts (Get-ADComputer, Get-ADUser), API pulls from Intune/Jamf/EDR to update last-seen and patch status, and scheduled network scans to detect new devices. For example, a nightly job can reconcile Intune-registered devices with AD computer objects and flag mismatches to an IT ticket queue for investigation.
Real-world scenarios and examples
Scenario 1 — Remote contractor access: a contractor logs in from a personal laptop to access a non-sensitive portal. The inventory should record that the device is unmanaged and flagged as prohibited for CUI access; the access policy should block or require a VPN jump host that enforces device posture. Scenario 2 — Manufacturing shop floor OT device: these devices often cannot run MDM/EDR. Record serial numbers, firmware version, network segment, and an assigned responsible engineer. Segment them on a separate VLAN and use NAC rules to limit their access. Scenario 3 — Lost device: an employee loses a corporate laptop; the inventory provides quick evidence of ownership, last-seen IP, and EDR presence to perform remote wipe and support breach assessment.
Risks of not implementing an authoritative inventory
Without an accurate inventory you risk orphaned accounts, unmanaged endpoints with exploitable vulnerabilities, inability to enforce least privilege or MFA, and failure to demonstrate identification during an audit — all of which increase the likelihood of unauthorized access and data exfiltration. For contractors and suppliers, lack of device identification can lead to CUI exposure and contract termination under FAR clauses. Operationally, incident response slows dramatically when you can't identify affected endpoints or their owners.
Compliance tips and best practices
Make these practices part of your Compliance Framework routine: 1) Tie inventory updates to HR events (onboarding/offboarding) and require ticket evidence for every change. 2) Enforce device enrollment before granting access to CUI — use conditional access policies (Azure AD Conditional Access, Okta) that check MDM/EDR posture. 3) Schedule monthly reconciliation between identity, MDM, and network scans and document exceptions. 4) Assign an asset owner for every device class and log all inventory changes with timestamps for audit trails. 5) Prioritize remediation by risk: devices accessing CUI or with privileged users come first.
In summary, creating an actionable inventory for FAR 52.204-21 and CMMC 2.0 IA.L1-B.1.V is a pragmatic combination of data modeling, tooling, and repeatable operational processes. For small businesses this can begin with AD/Azure AD exports, simple network discovery, and MDM/EDR enrollment, then mature into automated reconciliation and conditional access enforcement. The inventory is the single source of truth that enables identification, access control, and fast incident response — and getting it right materially reduces compliance and security risk.
