CM-2 Baseline Configuration
Control
a.
Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
b.
Review and update the baseline configuration of the system:
1.
[at least annually and when a significant change occurs];
2.
When required due to [to include when directed by the JAB] ; and
3.
When system components are installed or upgraded.
(b)(1) Guidance:
Significant change is defined in NIST Special Publication 800-37 Revision 2, Appendix F.
Discussion
Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.
FedRAMP-Defined Assignment / Selection Parameters
- CM-2 (b)(1) [at least annually and when a significant change occurs] - the frequency of baseline configuration review and update is defined;
- CM-2 (b)(2) [to include when directed by the JAB] - the circumstances requiring baseline configuration review and update are defined;