id: "CM-02(02)" title: "Automation Support for Accuracy and Currency" family: "CM" family_name: "Configuration Management" sort_id: "cm-02.02" priority: "P1" implementation_level: "organization" parent: "CM-02" enhancement: True
Statement
Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using {{ insert: param, cm-02.02_odp }}.
Guidance
Automated mechanisms that help organizations maintain consistent baseline configurations for systems include configuration management tools, hardware, software, firmware inventory tools, and network management tools. Automated tools can be used at the organization level, mission and business process level, or system level on workstations, servers, notebook computers, network components, or mobile devices. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels. Automation support for accuracy and currency can be satisfied by the implementation of CM-8(2) for organizations that combine system component inventory and baseline configuration activities.
Assessment Objective: the currency of the baseline configuration of the system is maintained using {{ insert: param, cm-02.02_odp }};
Assessment Objective: the completeness of the baseline configuration of the system is maintained using {{ insert: param, cm-02.02_odp }};
Assessment Objective: the accuracy of the baseline configuration of the system is maintained using {{ insert: param, cm-02.02_odp }};
Assessment Objective: the availability of the baseline configuration of the system is maintained using {{ insert: param, cm-02.02_odp }}.
Configuration management policy
procedures addressing the baseline configuration of the system
configuration management plan
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
system component inventory
configuration change control records
system security plan
other relevant documents or records
Organizational personnel with configuration management responsibilities
organizational personnel with information security responsibilities
system/network administrators
Organizational processes for managing baseline configurations
automated mechanisms implementing baseline configuration maintenance