Right now I'm using Action1 for the following:

• Patch Management
• Hardware Inventory
• Software Inventory

It checks vulnerabilities but in the way that it tells you if your software is patched or not essentially.
There is no CUI that is stored, process, or transferred by the system.

Are those things considered "Security Functions"? I understand like Meraki controllers as well as say a cloud controller for physical access systems.

If it is seen as such, what is everyone using for patch management as well as inventory?