CM-2 Baseline Configuration
Guidance: draftPolicy clause: draftWhat these mean
cm2ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Low, Moderate, High | Organization | 4 (3 in a baseline) |
Related controls: AC-19, AU-6, CA-9, CM-1, CM-3, CM-5, CM-6, CM-8, CM-9, CP-9, CP-10, CP-12, MA-2, PL-8, PM-5, SA-8, SA-10, SA-15, SC-18
Control statement
Section titled “Control statement”- a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
- b. Review and update the baseline configuration of the system:
- 1. [Assignment: organization-defined frequency];
- 2. When required due to [Assignment: organization-defined circumstances] ; and
- 3. When system components are installed or upgraded.
NIST discussion
Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.
Control enhancements
Section titled “Control enhancements”CM-2(2) Automation Support for Accuracy and Currency
Section titled “CM-2(2) Automation Support for Accuracy and Currency”Baselines: Moderate, High
Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].
Discussion and assessment objectives for CM-2(2)
Automated mechanisms that help organizations maintain consistent baseline configurations for systems include configuration management tools, hardware, software, firmware inventory tools, and network management tools. Automated tools can be used at the organization level, mission and business process level, or system level on workstations, servers, notebook computers, network components, or mobile devices. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels. Automation support for accuracy and currency can be satisfied by the implementation of CM-8(2) for organizations that combine system component inventory and baseline configuration activities.
Determine if:
- CM-02(02)[01] the currency of the baseline configuration of the system is maintained using [Assignment: organization-defined automated mechanisms];
- CM-02(02)[02] the completeness of the baseline configuration of the system is maintained using [Assignment: organization-defined automated mechanisms];
- CM-02(02)[03] the accuracy of the baseline configuration of the system is maintained using [Assignment: organization-defined automated mechanisms];
- CM-02(02)[04] the availability of the baseline configuration of the system is maintained using [Assignment: organization-defined automated mechanisms].
Examine: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; system component inventory; configuration change control records; system security plan; other relevant documents or records.
Interview: Organizational personnel with configuration management responsibilities; organizational personnel with information security responsibilities; system/network administrators.
Test: Organizational processes for managing baseline configurations; automated mechanisms implementing baseline configuration maintenance.
CM-2(3) Retention of Previous Configurations
Section titled “CM-2(3) Retention of Previous Configurations”Baselines: Moderate, High
Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback.
Discussion and assessment objectives for CM-2(3)
Retaining previous versions of baseline configurations to support rollback include hardware, software, firmware, configuration files, configuration records, and associated documentation.
Determine if [Assignment: organization-defined number] of previous baseline configuration version(s) of the system is/are retained to support rollback.
Examine: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system architecture and configuration documentation; system configuration settings and associated documentation; copies of previous baseline configuration versions; system security plan; other relevant documents or records.
Interview: Organizational personnel with configuration management responsibilities; organizational personnel with information security responsibilities; system/network administrators.
Test: Organizational processes for managing baseline configurations.
CM-2(6) Development and Test Environments
Section titled “CM-2(6) Development and Test Environments”Baselines: Not in a baseline
Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.
Discussion and assessment objectives for CM-2(6)
Establishing separate baseline configurations for development, testing, and operational environments protects systems from unplanned or unexpected events related to development and testing activities. Separate baseline configurations allow organizations to apply the configuration management that is most appropriate for each type of configuration. For example, the management of operational configurations typically emphasizes the need for stability, while the management of development or test configurations requires greater flexibility. Configurations in the test environment mirror configurations in the operational environment to the extent practicable so that the results of the testing are representative of the proposed changes to the operational systems. Separate baseline configurations do not necessarily require separate physical environments.
Determine if:
- CM-02(06)[01] a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained;
- CM-02(06)[02] a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.
Examine: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; system security plan; other relevant documents or records.
Interview: Organizational personnel with configuration management responsibilities; organizational personnel with information security responsibilities; system/network administrators.
Test: Organizational processes for managing baseline configurations; mechanisms implementing separate baseline configurations for development, test, and operational environments.
CM-2(7) Configure Systems and Components for High-risk Areas
Section titled “CM-2(7) Configure Systems and Components for High-risk Areas”Baselines: Moderate, High
- (a) Issue [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and
- (b) Apply the following controls to the systems or components when the individuals return from travel: [Assignment: organization-defined controls].
Discussion and assessment objectives for CM-2(7)
When it is known that systems or system components will be in high-risk areas external to the organization, additional controls may be implemented to counter the increased threat in such areas. For example, organizations can take actions for notebook computers used by individuals departing on and returning from travel. Actions include determining the locations that are of concern, defining the required configurations for the components, ensuring that components are configured as intended before travel is initiated, and applying controls to the components after travel is completed. Specially configured notebook computers include computers with sanitized hard drives, limited applications, and more stringent configuration settings. Controls applied to mobile devices upon return from travel include examining the mobile device for signs of physical tampering and purging and reimaging disk drives. Protecting information that resides on mobile devices is addressed in the MP (Media Protection) family.
Determine if:
- CM-02(07)(a) [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] are issued to individuals traveling to locations that the organization deems to be of significant risk;
- CM-02(07)(b) [Assignment: organization-defined controls] are applied to the systems or system components when the individuals return from travel.
Examine: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the system; procedures addressing system component installations and upgrades; system architecture and configuration documentation; system configuration settings and associated documentation; system component inventory; records of system baseline configuration reviews and updates; system component installations/upgrades and associated records; change control records; system security plan; other relevant documents or records.
Interview: Organizational personnel with configuration management responsibilities; organizational personnel with information security responsibilities; system/network administrators.
Test: Organizational processes for managing baseline configurations.
Withdrawn enhancements: CM-2(1), CM-2(4), CM-2(5).
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for CM-2
Determine if:
- CM-02a.
- CM-02a.[01] a current baseline configuration of the system is developed and documented;
- CM-02a.[02] a current baseline configuration of the system is maintained under configuration control;
- CM-02b.
- CM-02b.01 the baseline configuration of the system is reviewed and updated [Assignment: organization-defined frequency];
- CM-02b.02 the baseline configuration of the system is reviewed and updated when required due to [Assignment: organization-defined circumstances];
- CM-02b.03 the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.
Examine: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; enterprise architecture documentation; system design documentation; system security plan; privacy plan; system architecture and configuration documentation; system configuration settings and associated documentation; system component inventory; change control records; other relevant documents or records.
Interview: Organizational personnel with configuration management responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.
Test: Organizational processes for managing baseline configurations; mechanisms supporting configuration control of the baseline configuration.
Policy statement
- The System owner shall develop, document and maintain under configuration control a current baseline configuration of the system. (CM-2a)
- The System owner shall review and update the baseline configuration Fill in: the frequency of baseline configuration review and update Typical: at least annually. (CM-2b.1)
- The System owner shall review and update the baseline configuration when required by Fill in: the circumstances requiring baseline configuration review and update Typical: a significant change to the system, a new version of the secure configuration it is based on, or a security incident. (CM-2b.2)
- The System owner shall review and update the baseline configuration when system components are installed or upgraded. (CM-2b.3)
CM-2(2) Automation support for accuracy and currency
- The System owner shall maintain the currency, completeness, accuracy and availability of the baseline configuration using Fill in: automated mechanisms for maintaining baseline configuration of the system Typical: configuration management and infrastructure-as-code tools that record the approved baseline. (CM-2(2))
CM-2(3) Retention of previous configurations
- The System owner shall retain Fill in: the number of previous baseline configuration versions to be retained Typical: at least the two most recent previous versions of the baseline configuration to support rollback. (CM-2(3))
CM-2(7) Configure systems and components for high-risk areas
- The Chief Information Security Officer shall ensure individuals traveling to locations the organization deems to be of significant risk are issued Fill in: the systems or system components to be issued when individuals travel to high-risk areas Typical: loaner laptops and mobile devices with Fill in: configurations for systems or system components to be issued when individuals travel to high-risk areas Typical: a minimal configuration with full-disk encryption, no stored organizational data and access only through the organization’s VPN. (CM-2(7)(a))
- When those individuals return, the Chief Information Security Officer shall ensure the following controls are applied to the devices: Fill in: the controls to be applied when the individuals return from travel Typical: inspecting the device, wiping and reimaging it before reuse, and resetting the user’s credentials. (CM-2(7)(b))
From the Configuration Management Policy template (draft). Highlighted fields are values your organization sets.
How to apply it
Section titled “How to apply it”A baseline configuration is the approved, documented state of the system: its components, their versions and their settings. Every later configuration control, from change control (CM-3) to settings (CM-6), measures against it.
Common implementations. Infrastructure as code or configuration management tooling that records the approved state (CM-2(2)), images or templates for each component type, and version control that keeps previous baselines for rollback (CM-2(3)). The baseline is updated through change control, not by hand. Loaner devices for high-risk travel get a minimal configuration (CM-2(7)). The baseline configuration standard records each configuration item’s secure configuration and version, and the component inventory the components it covers.
Organization-defined parameters. Typical values, which your organization may set differently:
| Parameter | Typical value |
|---|---|
| Review frequency (b.1) | At least annually |
| Circumstances requiring review (b.2) | A significant change to the system, a new version of the secure configuration it is based on, or a security incident |
| Previous baselines retained (CM-2(3)) | At least the two most recent |
Evidence assessors ask for.
- The baseline configuration document or repository, with its version history
- Evidence of the last review and the changes approved since
- A comparison of a sample of components against the baseline
Inheritance. Platform images and cloud landing zones may be common; the system owns its own baseline.
Common findings.
- A baseline document that no longer matches the running system.
- No record of previous versions, so rollback is guesswork.
- Components added outside change control and never added to the baseline.
Enhancements in the Moderate baseline. CM-2(2) automation support, CM-2(3) retention of previous configurations and CM-2(7) configurations for high-risk areas.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.