CMMC Practice CM.L2-3.4.1 – System Baselining: Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
Links to Publicly Available Resources
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. Configuration baselines in Configuration Manager contain predefined configuration items and optionally, other configuration baselines. After a configuration baseline is created, you can deploy it to a collection so that devices in that collection download the configuration baseline and assess their compliance with it. This blog covers the Microsoft Security Compliance toolkit as a tool to audit security baselines. This toolkit is set of tools produced by Microsoft so organizations can apply Microsoft-recommended security configurations to their environment. This article helps identify key controls that should be considered when establishing a secure configuration. This NIST Special Publication covers general guidelines for ensuring that security considerations are integrated into the configuration management process. This is a sample configuration management policy from the State of North Carolina that outlines the standards used for configuration management compliance. This SANS whitepaper focuses on monitoring windows and linux baselines. Overview of Configuration Management including cost, popular tools, best practices, and risk for not implementing proper CM. This guide was created to assist individuals responsible for designing, managing, or deploying cybersecurity resilience controls, including executives who establish policies and priorities for asset management, managers and planners who are responsible for converting executive decisions into plans, and operations staff who implement the plans and participate in the implementation of organizational assets. This guidance from US-CERT is intended for organizations seeking help in establishing a configuration and change management process and for organizations seeking to improve their existing configuration and change management process.
Discussion [NIST SP 800-171 R2]
This requirement establishes and maintains baseline configurations for systems and system components including for system communications and connectivity. Baseline configurations are documented, formally reviewed, and agreed-upon sets of specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, and changes to systems. Baseline configurations include information about system components (e.g., standard software packages installed on workstations, notebook computers, servers, network components, or mobile devices; current version numbers and update and patch information on operating systems and applications; and configuration settings and parameters), network topology, and the logical placement of those components within the system architecture. Baseline configurations of systems also reflect the current enterprise architecture. Maintaining effective baseline configurations requires creating new baselines as organizational systems change over time. Baseline configuration maintenance includes reviewing and updating the baseline configuration when changes are made based on security risks and deviations from the established baseline configuration.
Organizations can implement centralized system component inventories that include components from multiple organizational systems. In such situations, organizations ensure that the resulting inventories include system-specific information required for proper component accountability (e.g., system association, system owner). Information deemed necessary for effective accountability of system components includes hardware inventory specifications, software license information, software version numbers, component owners, and for networked components or devices, machine names and network addresses. Inventory specifications include manufacturer, device type, model, serial number, and physical location.
NIST SP 800-128 provides guidance on security-focused configuration management.
Further Discussion
An effective cybersecurity program depends on consistent, secure system and component configuration and management. Build and configure systems from a known, secure, and approved configuration baseline. This includes:
- documenting the software and configuration settings of a system;
- placement within the network; and
- other specifications as required by the organization