I'd suggest this be an ERROR for less than two (2) inventory items, as FedRAMP requires at least two instances of a system.
I'd also suggest this be a WARNING for less than 20 inventory items as I've never encountered an inventory list that small, but believe it is possible. (The warning number should probably be even higher than 20, but this is a safe starting point. We can tune it upward later.)

Following @brian-ruf's first comment (Brian, thanks), modified Metapath as follows:

count(inventory-item) >= 2

As for the second comment, I have my doubts. If FedRAMP does not explicitly provision that there should be no fewer than 20 inventory items, I would hesitate to throw unnecessary warnings at users.

Thoughts?

I'd suggest this be an ERROR for less than two (2) inventory items, as FedRAMP requires at least two instances of a system. I'd also suggest this be a WARNING for less than 20 inventory items as I've never encountered an inventory list that small, but believe it is possible. (The warning number should probably be even higher than 20, but this is a safe starting point. We can tune it upward later.)

Interesting, can you explain where the ballpark of 2 < x < 20 comes from?

First, I feel strongly about 2 >= x, and am a lot softer on x < 20.

2 >= x because FedRAMP requires a primary and alternate site for every system. So even a system that requires just one inventory item would need at least two as a result of the redundancy requirement. That's also why this should be an ERROR. I feel strongly that this is the minimum.

x < 20 because I am unaware of any FedRAMP system with less than 10 distinct items ( x 2 locations = 20). FedRAMP inventory lists usually involve 100's or 1,000's of entries. So if there are less than 20 inventory items the most-likely reason by far is is missing inventory. (WARNING)

I can stand down on x < 20. It was just a suggestion. I was approaching it similar to the way thresholds are tuned for SOC monitoring and alerting, where 20 is an expert judgement for what is likely to be good, and then can later be tuned up or down as we get real-world data to support a more appropriate threshold.

If we were to include this threshold, there is also a case to be made that x < 20 is more of a SaaS minimum. PaaS and IaaS minimum should be more like x < 100.

First, I feel strongly about 2 >= x, and am a lot softer on x < 20.

I am all about heuristics, this is good stuff, I just wanted to see it written down. 😄