This objective requires your organization to define and document baseline configurations for your systems—especially those that store, process, or transmit Controlled Unclassified Information (CUI). A baseline includes the approved operating system, installed software, configurations, and security settings for each system type.