+CM-02 Baseline Configuration
---+CM-02(02) Automation Support for Accuracy and Currency
---+CM-02(03) Retention of Previous Configurations
---+CM-02(06) Development and Test Environments
---+CM-02(07) Configure Systems and Components for High-risk Areas

CM-02 Baseline Configuration

Control

  1. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
  2. Review and update the baseline configuration of the system:
    1. [Assignement: frequency];
    2. When required due to [Assignement: circumstances] ; and
    3. When system components are installed or upgraded.

Discussion

Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.

Assessment Objective

    1. a current baseline configuration of the system is developed and documented;
    2. a current baseline configuration of the system is maintained under configuration control;
    1. the baseline configuration of the system is reviewed and updated [Assignement: frequency];
    2. the baseline configuration of the system is reviewed and updated when required due to [Assignement: circumstances];
    3. the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.

Assessment Method

Examine

Configuration management policy procedures addressing the baseline configuration of the system configuration management plan enterprise architecture documentation system design documentation system security plan privacy plan system architecture and configuration documentation system configuration settings and associated documentation system component inventory change control records other relevant documents or records

Interview

Organizational personnel with configuration management responsibilities organizational personnel with information security and privacy responsibilities system/network administrators

1. Panoramica

CM-02(02) Automation Support for Accuracy and Currency

Control

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignement: automated mechanisms].

Discussion

Automated mechanisms that help organizations maintain consistent baseline configurations for systems include configuration management tools, hardware, software, firmware inventory tools, and network management tools. Automated tools can be used at the organization level, mission and business process level, or system level on workstations, servers, notebook computers, network components, or mobile devices. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels. Automation support for accuracy and currency can be satisfied by the implementation of [CM-8(2)](#cm-8.2) for organizations that combine system component inventory and baseline configuration activities.

Assessment Objective

  1. the currency of the baseline configuration of the system is maintained using [Assignement: automated mechanisms];
  2. the completeness of the baseline configuration of the system is maintained using [Assignement: automated mechanisms];
  3. the accuracy of the baseline configuration of the system is maintained using [Assignement: automated mechanisms];
  4. the availability of the baseline configuration of the system is maintained using [Assignement: automated mechanisms].

Assessment Method

Examine

Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation system component inventory configuration change control records system security plan other relevant documents or records

Interview

Organizational personnel with configuration management responsibilities organizational personnel with information security responsibilities system/network administrators
CM-02(03) Retention of Previous Configurations

Control

Retain [Assignement: number] of previous versions of baseline configurations of the system to support rollback.

Discussion

Retaining previous versions of baseline configurations to support rollback include hardware, software, firmware, configuration files, configuration records, and associated documentation.

Assessment Objective

[Assignement: number] of previous baseline configuration version(s) of the system is/are retained to support rollback.

Assessment Method

Examine

Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system architecture and configuration documentation system configuration settings and associated documentation copies of previous baseline configuration versions system security plan other relevant documents or records

Interview

Organizational personnel with configuration management responsibilities organizational personnel with information security responsibilities system/network administrators
CM-02(06) Development and Test Environments

Control

Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.

Discussion

Establishing separate baseline configurations for development, testing, and operational environments protects systems from unplanned or unexpected events related to development and testing activities. Separate baseline configurations allow organizations to apply the configuration management that is most appropriate for each type of configuration. For example, the management of operational configurations typically emphasizes the need for stability, while the management of development or test configurations requires greater flexibility. Configurations in the test environment mirror configurations in the operational environment to the extent practicable so that the results of the testing are representative of the proposed changes to the operational systems. Separate baseline configurations do not necessarily require separate physical environments.

Assessment Objective

  1. a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained;
  2. a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.

Assessment Method

Examine

Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation system security plan other relevant documents or records

Interview

Organizational personnel with configuration management responsibilities organizational personnel with information security responsibilities system/network administrators
CM-02(07) Configure Systems and Components for High-risk Areas

Control

  1. Issue [Assignement: systems or system components] with [Assignement: configurations] to individuals traveling to locations that the organization deems to be of significant risk; and
  2. Apply the following controls to the systems or components when the individuals return from travel: [Assignement: controls].

Discussion

When it is known that systems or system components will be in high-risk areas external to the organization, additional controls may be implemented to counter the increased threat in such areas. For example, organizations can take actions for notebook computers used by individuals departing on and returning from travel. Actions include determining the locations that are of concern, defining the required configurations for the components, ensuring that components are configured as intended before travel is initiated, and applying controls to the components after travel is completed. Specially configured notebook computers include computers with sanitized hard drives, limited applications, and more stringent configuration settings. Controls applied to mobile devices upon return from travel include examining the mobile device for signs of physical tampering and purging and reimaging disk drives. Protecting information that resides on mobile devices is addressed in the [MP](#mp) (Media Protection) family.

Assessment Objective

  1. [Assignement: systems or system components] with [Assignement: configurations] are issued to individuals traveling to locations that the organization deems to be of significant risk;
  2. [Assignement: controls] are applied to the systems or system components when the individuals return from travel.

Assessment Method

Examine

Configuration management policy configuration management plan procedures addressing the baseline configuration of the system procedures addressing system component installations and upgrades system architecture and configuration documentation system configuration settings and associated documentation system component inventory records of system baseline configuration reviews and updates system component installations/upgrades and associated records change control records system security plan other relevant documents or records

Interview

Organizational personnel with configuration management responsibilities organizational personnel with information security responsibilities system/network administrators

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by CM-02 Baseline Configuration – Assessment Procedure
is blocked by Secure Baseline Configurations
is blocked by Baseline Configuration Reviews & Updates