Baseline Configuration CM-2
Configuration Management · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds CM-2 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Configuration Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
CM-2 (Baseline Configuration) requires developing, documenting, and maintaining a current, approved baseline of the system — its components, software, versions, and settings — and updating that baseline under change control as the system changes. It is a foundational Configuration Management control that carries from the Low baseline up into Moderate.
What good looks like
- Document an approved baseline: the components, software inventory, versions, network layout, and configuration settings that make up the known-good system.
- Take the baseline at defined points — for example after hardening, or before a major change — so you have a clean reference to compare against and roll back to.
- Keep the baseline current: review and update it under change control whenever components or settings change.
- Retain previous baseline versions so you can restore or roll back to a known-good state.
- At Moderate, detect drift from the baseline and keep the reference consistent and available.
Framework mapping
- NIST CSF 2.0 — PR.PS-01 — Configuration management practices are established and applied
- CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software
How to move it toward Implemented
- This is met on VM 607: the hardened baseline is captured three ways — the AIDE (Advanced Intrusion Detection Environment)
aide.dbfile-integrity database, a dated as-built text snapshot, and the Proxmoxpinkteam-baselinesnapshot — andsudo aide --checkproves the live system still matches it. - Attach the dated as-built file plus the Proxmox
pinkteam-baselinesnapshot ID as evidence, naming CM-2 in the Requirement field, to move it to Completed. - Schedule a recurring
aide --checkand re-capture the as-built after any approved change, so the recorded baseline stays current rather than one-time (CM-2's 'maintain' requirement).