CM-2 Baseline Configuration
Control
Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
Review and update the baseline configuration of the system:
[Assignment: frequency];
When required due to [Assignment: circumstances] ; and
When system components are installed or upgraded.
Discussion
Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.
Control enhancements (7)
- CM-2(1)Reviews and Updates
- CM-2(2)Automation Support for Accuracy and CurrencyMODERATEHIGH
- CM-2(3)Retention of Previous ConfigurationsMODERATEHIGH
- CM-2(4)Unauthorized Software
- CM-2(5)Authorized Software
- CM-2(6)Development and Test Environments
- CM-2(7)Configure Systems and Components for High-risk AreasMODERATEHIGH
Related controls
Need CM-2 implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.