CM.L2-3.4.1: System Baselining for CMMC Level 2
System baselining is your foundational defense against configuration drift and unauthorized changes. CMMC Level 2 requires you to establish and maintain comprehensive baselines of hardware, software, firmware, and documentation across your entire development lifecycle. Without this baseline, you can't detect what's changed—or who changed it.
What this means
This control requires you to create and sustain detailed baseline configurations and inventories of all organizational information systems. Your baseline must capture the approved state of every hardware device, installed software, firmware version, and supporting documentation. You must maintain these baselines throughout the system development lifecycle, from initial deployment through updates and patches, ensuring that any deviation is detectable and traceable.
How to comply
- 1.Document approved baseline configurations for all hardware, software, and firmware components in your environment
- 2.Create a centralized inventory system that tracks all devices, applications, versions, and ownership
- 3.Establish a change control process that requires baseline updates before any system modification
- 4.Implement configuration monitoring tools to detect deviations from approved baselines in real-time
- 5.Review and update baselines quarterly or whenever system changes occur
- 6.Maintain audit logs that tie baseline changes to authorized change requests and approvals
- 7.Archive previous baseline versions for historical comparison and incident investigation
Evidence auditors look for
- Baseline configuration documentation for servers, workstations, and network devices with version control
- Software inventory with approved versions, licenses, and installation dates
- Firmware inventory listing device types, current versions, and update schedules
- Change control records showing baseline approvals before any system modification
- Configuration monitoring reports demonstrating detection of drift from baselines
- System development lifecycle documentation mapping baselines to each project phase
- Audit logs showing who accessed, modified, or deployed baselines and when
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates baseline documentation and change tracking, allowing you to maintain audit-ready configuration inventories and detect drift instantly without manual spreadsheet management.
See how GRCWatch handles this control automatically
Start free trial