Establish and maintain baseline configurations and inventories
📖 What This Means
This control requires organizations to document and maintain standardized 'baseline' configurations for all hardware and software systems that handle Controlled Unclassified Information (CUI). Think of it like creating a master recipe for your IT systems - you need to document the exact settings, versions, and components that are approved for use, then track any changes made. For example, your baseline might specify that all Windows workstations must have automatic updates enabled, firewall rules configured, and only approved software installed. Another example: a network switch baseline would document firmware versions, password policies, and port configurations. The goal is to prevent security gaps caused by inconsistent or undocumented configurations.
🎯 Why It Matters
Uncontrolled configurations are a top cause of security breaches. The 2023 Verizon DBIR found 60% of breaches involved vulnerabilities for which a patch was available but not implemented - often because organizations lacked configuration baselines to track required updates. A real-world example: a defense contractor was breached when an engineer installed unapproved remote access software on a CUI-handling workstation that didn't match the security baseline. The DoD specifically requires this control because inconsistent configurations make systems vulnerable to exploitation and complicate incident response. Potential impacts include: $500K+ in incident response costs, loss of CUI (average $180/record in breach costs), and contract disqualification.
✅ How to Implement
- 1. Use cloud-native tools like AWS Systems Manager or Azure Automation to capture baseline configurations of all cloud resources
- 2. Document security settings for IAM policies, storage buckets, and network ACLs in a cloud configuration template
- 3. Enable drift detection (e.g., AWS Config Rules) to identify unauthorized changes
- 4. Export cloud inventory reports monthly (e.g., AWS EC2 Inventory or Azure Resource Graph)
- 5. Store baselines in version control (e.g., GitLab) with change history
📋 Evidence Examples
Baseline Configuration Document
Hardware Inventory Report
Configuration Change Log
Drift Detection Report
Baseline Review Meeting Minutes
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For CM.L2-3.4.1 ("Establish and maintain baseline configurations and inventories"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe your configuration management process, including baseline configurations, change control procedures, vulnerability management, and how configuration compliance is monitored and enforced. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"CM.L2-3.4.1 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to establish and maintain baseline configurations and inventories. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"CM.L2-3.4.1 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to establish and maintain baseline configurations and inventories. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"CM.L2-3.4.1 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all system types within the CUI boundary requiring baselines
- • Document configuration management tools and CMDB
- • Map change control workflow from request to implementation
- • Ensure this control covers all systems within your defined CUI boundary where establish and maintain baseline configurations and inventories applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Configuration Management Policy
- 📄 Baseline configuration documents
- 📄 Change management records
- 📄 CMDB/asset inventory
- 📄 Evidence artifacts specific to CM.L2-3.4.1
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will compare actual system configurations against documented baselines, review change tickets for proper approval workflow, and verify vulnerability remediation within SLA.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have documented baseline configurations for all systems handling CUI?
Question 2: Can you produce an up-to-date inventory of all hardware/software that handles CUI?
Question 3: Do you have a process to detect and remediate configuration drift?
Question 4: Are baseline reviews conducted at least annually?
Question 5: Can you show evidence of baseline enforcement (e.g., automated remediation of non-compliant systems)?
⚠️ Common Mistakes (What Auditors Flag)
1. Missing network devices in inventory
2. Baselines not updated after upgrades
3. No process to handle exceptions
4. Spreadsheet inventories that quickly become outdated
5. No version control for baseline documents
📚 Parent Policy
This practice is governed by the Configuration Management Policy