Mapped Requirement and Assessment Objective
Mapped to NIST 800-171 requirement 3.4.1 and CMMC Level 2 assessment objective CM.L2-3.4.1[b].
What This Objective Means
This objective ensures your baseline configurations are formally documented, aligned with your system architecture, and available for review during audits or assessments.
Written baselines provide a clear reference for how systems are configured and maintained rather than relying on memory or undocumented practices.:contentReference[oaicite:0]{index=0}
Why It Matters
If baselines are not documented, assessors cannot verify configuration standards, and your organization risks configuration drift, misconfigurations, and failed evaluations. Baseline documentation supports repeatable, secure, and traceable system configurations.:contentReference[oaicite:1]{index=1}
How to Implement CM 3.4.1b
Create or compile baseline configuration documentation for each major system type, including workstations, servers, network devices, and cloud environments.
Ensure each baseline includes key details such as OS version and build information, required security settings, approved software and services, and references to hardening guides.
Store documented baselines in a controlled repository with versioning so updates over time can be tracked and audited as part of your broader compliance framework overview.:contentReference[oaicite:2]{index=2}
Baseline Documentation Summary Table
| Element | Description |
|---|---|
| System Type | Identify the type of system for which the baseline applies (workstation, server, network device, etc.). |
| Configuration Details | Document OS versions, security settings, installed applications, and approved services. |
| Hardening References | Reference any hardening guides used (e.g., CIS, STIG, organizational standards). |
| Version Control | Track baseline versions, changes made, and who approved them. |
| Repository & Review | Store baselines in a controlled repository and review them as part of routine configuration management. |
Evidence Assessors Commonly Expect
Assessors typically expect formally documented baseline configuration files for each major system type, screenshots or exports of configuration templates, version-controlled documents, and references to these baselines in your System Security Plan (SSP).:contentReference[oaicite:3]{index=3}
Common Gaps to Avoid
Common gaps include baselines applied without documentation, golden images used without associated written standards, and baselines that exist only in deployment tools without accessible documentation.:contentReference[oaicite:4]{index=4}
FAQ
What does CM.L2-3.4.1b require?
It requires documented baseline configurations that clearly describe how systems are configured and maintained and are available for review.:contentReference[oaicite:5]{index=5}
Where should baseline documentation be stored?
Baseline documentation should be stored in a controlled repository with version control and referenced in your SSP and configuration management artifacts.:contentReference[oaicite:6]{index=6}
What evidence can demonstrate compliance with this objective?
Evidence includes formal baseline documents, screenshots or exports of configuration settings, version control histories, and documentation showing references to baselines in policies or the SSP.:contentReference[oaicite:7]{index=7}