id: "CM-02" title: "Baseline Configuration" family: "CM" family_name: "Configuration Management" sort_id: "cm-02" priority: "P1" implementation_level: "organization" enhancements: - cm-2.1 - cm-2.2 - cm-2.3 - cm-2.4 - cm-2.5 - cm-2.6 - cm-2.7
Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
Review and update the baseline configuration of the system:
{{ insert: param, cm-02_odp.01 }};
When required due to {{ insert: param, cm-02_odp.02 }} ; and
When system components are installed or upgraded.
Guidance
Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.
Assessment Objective: a current baseline configuration of the system is developed and documented;
Assessment Objective: a current baseline configuration of the system is maintained under configuration control;
Assessment Objective: the baseline configuration of the system is reviewed and updated {{ insert: param, cm-02_odp.01 }};
Assessment Objective: the baseline configuration of the system is reviewed and updated when required due to {{ insert: param, cm-02_odp.02 }};
Assessment Objective: the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.
Configuration management policy
procedures addressing the baseline configuration of the system
configuration management plan
enterprise architecture documentation
system design documentation
system security plan
privacy plan
system architecture and configuration documentation
system configuration settings and associated documentation
system component inventory
change control records
other relevant documents or records
Organizational personnel with configuration management responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
Organizational processes for managing baseline configurations
mechanisms supporting configuration control of the baseline configuration