Assessment Objective
Determine if:
- CM-02a.
- CM-02a.[01] a current baseline configuration of the system is developed and documented;
- CM-02a.[02] a current baseline configuration of the system is maintained under configuration control;
- CM-02b.
- CM-02b.01 the baseline configuration of the system is reviewed and updated [Assignment: frequency];
- CM-02b.02 the baseline configuration of the system is reviewed and updated when required due to [Assignment: circumstances];
- CM-02b.03 the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing the baseline configuration of the system
- configuration management plan
- enterprise architecture documentation
- system design documentation
- system security plan
- privacy plan
- system architecture and configuration documentation
- system configuration settings and associated documentation
- system component inventory
- change control records
- other relevant documents or records
Interview
- Organizational personnel with configuration management responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
Test
- Organizational processes for managing baseline configurations
- mechanisms supporting configuration control of the baseline configuration
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | CM-02 [M] Baseline Configuration |