3.4.1

Requirement

a. Develop and maintain under configuration control, a current baseline configuration of the system.
b. Review and update the baseline configuration of the system [Assignment: organization-defined frequency] and when system components are installed or modified.

Discussion

Baseline configurations for the system and system components include aspects of connectivity, operation, and communications. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for the system or configuration items within the system. Baseline configurations serve as a basis for future builds, releases, or changes to the system and include information about system components, operational procedures, network topology, and the placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as the system changes over time. Baseline configurations of the system reflect the current enterprise architecture.

NIST 800-171A r3 Assessment Guidance

Examine

[SELECT FROM: configuration management policy and procedures; procedures for the baseline system configuration; configuration management plan; enterprise architecture; system design documentation; system architecture; system configuration settings; system component inventory; change control records; system security plan; other relevant documents or records]
Interview

[SELECT FROM: processes for managing baseline configurations; mechanisms for supporting configuration control of the baseline configuration]
Test

[SELECT FROM: personnel with configuration management responsibilities; personnel with information security responsibilities; system administrators]

ID	Assessment Objectives
A.03.04.01.a[01]	a current baseline configuration of the system is developed.
A.03.04.01.a[02]	a current baseline configuration of the system is maintained under configuration control.
A.03.04.01.b[01]	the baseline configuration of the system is reviewed .
A.03.04.01.b[02]	the baseline configuration of the system is updated .
A.03.04.01.b[03]	the baseline configuration of the system is reviewed when system components are installed or modified.
A.03.04.01.b[04]	the baseline configuration of the system is updated when system components are installed or modified.
A.03.04.01.ODP[01]	the frequency of baseline configuration review and update is defined.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!