Every secure system starts from a known, approved state. If you can't say what your systems are supposed to look like — or what's actually in your environment — you can't tell when something has changed without authorization.
Control CM.L2-3.4.1 is the foundation of the Configuration Management domain. It requires organizations to define how their systems should be configured and to keep track of every component that makes up those systems, from hardware and software to firmware and documentation.
This guide breaks down what CM.L2-3.4.1 means in plain language, what assessors expect to see, and how to put the control into practice.
What is Control CM.L2-3.4.1 – System Baselining?
Control CM.L2-3.4.1 states that organizations must establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
The purpose of this control is to establish standardized system configurations and maintain an up-to-date inventory of IT assets so that unauthorized changes and security misconfigurations are prevented. In practice, that means documenting approved system states, tracking all system components, and enforcing configuration controls to maintain security, compliance, and operational stability.
This control aligns closely with CM.L2-3.4.6, which requires organizations to employ automated mechanisms to maintain an accurate and up-to-date inventory of system components.
Baseline Configurations vs. System Inventories
CM.L2-3.4.1 asks for two related but distinct things. Both are critical for system security and management, but they serve different functions:
- Baseline configurations — Define the approved security settings, software versions, and system configurations that must be maintained to ensure security and consistency. They serve as a reference point so that changes are properly managed and unauthorized modifications are detected.
- System inventories — Track all organizational IT assets, including hardware, software, and firmware, ensuring visibility and accountability. A well-maintained inventory lets you track assets, prevent unauthorized devices or software, and maintain configuration control throughout the system's lifecycle.
Together, these practices support effective change control, vulnerability management, and security monitoring in alignment with NIST SP 800-171 Rev. 2 requirements.
CM.L2-3.4.1 Assessment Objectives
When assessing this control, the following must be determinable:
Assessment Objectives
- A baseline configuration is established A
- The baseline configuration includes hardware, software, firmware, and documentation B
- The baseline configuration is maintained (reviewed and updated) throughout the system development life cycle C
- A system inventory is established D
- The system inventory includes hardware, software, firmware, and documentation E
- The inventory is maintained (reviewed and updated) throughout the system development life cycle F
Notice the structure: objectives [a] through [c] cover the baseline configuration, and objectives [d] through [f] mirror them for the system inventory. For each one, it isn't enough to create it once — it must cover all four component types and be reviewed and updated throughout the system development life cycle.
Spirit of the Control
This control ensures that organizations define, document, and maintain baseline configurations and inventories of all system components to support effective security, change management, and risk mitigation.
Baseline configurations serve as a reference point for system security settings, approved software versions, and hardware configurations, ensuring that changes are properly managed and unauthorized modifications are detected. A well-maintained inventory of hardware, software, firmware, and system documentation allows organizations to track assets, prevent unauthorized devices or software, and maintain configuration control throughout the system's lifecycle.
Discussion from NIST 800-171 R2
NIST describes baseline configurations as documented, formally reviewed, and agreed-upon sets of specifications for systems or configuration items within those systems. They serve as a basis for future builds, releases, and changes to systems, and they cover system communications and connectivity as well.
What a Baseline Configuration Includes
- Information about system components — for example, standard software packages installed on workstations, notebook computers, servers, network components, or mobile devices
- Current version numbers and update and patch information on operating systems and applications
- Configuration settings and parameters
- Network topology and the logical placement of components within the system architecture
Baseline configurations should also reflect the current enterprise architecture. Because systems change over time, maintaining effective baselines requires creating new baselines as those changes occur. Maintenance includes reviewing and updating the baseline when changes are made, based on security risks and deviations from the established baseline.
What a System Inventory Should Capture
Organizations can implement centralized system component inventories that include components from multiple organizational systems. In that case, the inventory must still include system-specific information required for proper component accountability, such as system association and system owner. Information necessary for effective accountability includes:
- Hardware inventory specifications
- Software license information
- Software version numbers
- Component owners
- For networked components or devices, machine names and network addresses
Inventory specifications include manufacturer, device type, model, serial number, and physical location.
NIST SP 800-128 provides guidance on security-focused configuration management.
Further Discussion
An effective cybersecurity program depends on consistent, secure system and component configuration and management. Systems should be built and configured from a known, secure, and approved configuration baseline. This includes:
- Documenting the software and configuration settings of a system
- Placement within the network
- Other specifications as required by the organization
The example touches every part of the control: a documented, tested baseline, an inventory updated to reflect the changes, and a scheduled review to keep the baseline maintained.
Common Ways to Meet Control CM.L2-3.4.1
Organizations can satisfy this control if they:
- Develop and document baseline configurations: Define standard configurations for operating systems, network devices, applications, and security settings.
- Use configuration management tools: Leverage automated tools such as SCCM, Ansible, Chef, or Puppet to track and enforce baseline configurations.
- Maintain an asset inventory: Implement automated asset management solutions to continuously track and update hardware, software, and firmware inventories.
- Enforce change control processes: Require formal change approvals and documentation before modifying baseline configurations.
- Implement system hardening standards: Apply security baselines such as CIS Benchmarks, DISA STIGs, or vendor-recommended settings to protect system integrity.
- Regularly audit and update configurations: Perform periodic reviews and updates to baseline configurations to reflect system changes, patches, and security enhancements.
- Ensure system documentation is up-to-date: Maintain accurate documentation of system configurations, network diagrams, and software inventories to support security and compliance.
What Assessors Look For
Assessors typically review:
- Documented baseline configurations, detailing approved system settings, software versions, and security controls
- Records of baseline configuration updates, demonstrating that configurations are reviewed and updated as needed
- System component inventories, including lists of authorized hardware, software, firmware, and associated documentation
- Change management logs, showing approved modifications to baseline configurations and system inventories
- Evidence of automated configuration management tools, such as system scans or reports verifying compliance with baselines
- Security audits or configuration reviews, ensuring that systems adhere to established baselines and unauthorized changes are detected
Potential assessment considerations to prepare for:
Do your baseline configurations include software versions and patch level, configuration parameters, network information, and communications with connected systems? Are your baseline configurations updated as needed to accommodate security risks or software changes? [NIST Handbook 162 section 3.4.1]
Potential Assessment Methods
Examine
Configuration management policy; procedures addressing the baseline configuration of the system; procedures addressing system inventory; system security plan; configuration management plan; system inventory records; inventory review and update records; enterprise architecture documentation; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; change control records; system component installation records; system component removal records; other relevant documents or records.
Interview
Personnel with configuration management responsibilities; personnel with responsibilities for establishing the system inventory; personnel with responsibilities for updating the system inventory; personnel with information security responsibilities; system or network administrators.
Test
Organizational processes for managing baseline configurations; mechanisms supporting configuration control of the baseline configuration; organizational processes for developing and documenting an inventory of system components; organizational processes for updating inventory of system components; mechanisms supporting or implementing the system inventory; mechanisms implementing updating of the system inventory.
Remediation Recommendation
If you are not currently meeting this control, the path forward is:
Inventory and categorize all assets, including hardware, software, and firmware. Determine a configuration baseline for each configuration item, including the baseline configuration standard your organization will be adhering to (DISA STIGs, CIS Benchmarks, or a hybrid model). The standard should document a set of specifications for the in-scope systems and configuration items. It must be periodically reviewed to account for changes in the environment, including new vulnerabilities and risks — and it must only be changed through change control procedures in accordance with local policy.
References
- NIST SP 800-128: Guide for Security-Focused Configuration Management
- DHS Cyber Resilience Review (CRR) Resource Guide, Volume 3: Configuration and Change Management, v1.1
How CM.L2-3.4.1 Connects to Other Controls
CM.L2-3.4.1 is closely tied to its neighbor in the Configuration Management domain and maps to several other frameworks:
Think of CM.L2-3.4.1 as the reference point for your entire configuration management program. Without a documented baseline and a current inventory, there is nothing to measure changes against.
How ASCERA Helps with CM.L2-3.4.1
Building baselines and inventories is the hard part. Proving it to an assessor is where ASCERA comes in.
ASCERA tracks each of the six assessment objectives for this control independently, so if you've established your baseline and inventory but haven't yet shown that they're reviewed and updated — you'll see that gap before your assessor does.
Evidence uploads attach directly to the control and automatically map across related controls, so your baseline documentation, inventory records, and change control logs work harder across your entire compliance program, not just here.
Every control in ASCERA comes with built-in written and video guidance covering what to implement, what to document in your SSP, and what a strong evidence package looks like — so you're never starting from scratch.
See ASCERA in Action
Want to see how ASCERA tracks controls, manages evidence, and keeps your compliance program audit-ready?
Schedule a Free Demo