CM-2(3)

Requirement

Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback.

Discussion

Retaining previous versions of baseline configurations to support rollback include hardware, software, firmware, configuration files, configuration records, and associated documentation.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system architecture and configuration documentation; system configuration settings and associated documentation; copies of previous baseline configuration versions; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with configuration management responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes for managing baseline configurations].

ID	Assessment Objectives
CM-02(03)	<CM-02(03)_ODP number> of previous baseline configuration version(s) of the system is/are retained to support rollback.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!