Establish and maintain secure baseline configurations — 9 requirements covering 23 total SPRS points.
The Configuration Management domain requires organizations to establish and maintain baseline configurations for their systems, control changes to those configurations, and minimize the attack surface by limiting unnecessary functionality. Misconfiguration is consistently among the top causes of security incidents in the DIB. Default settings, unnecessary services, and uncontrolled changes create exploitable openings. A documented, enforced baseline configuration is one of the highest-value security investments a small contractor can make.
Every NIST SP 800-171 Rev 2 requirement in the CM family, with SPRS point weight and POA&M eligibility.
| Requirement | Description | Points | POA&M |
|---|---|---|---|
| CM.L2-3.4.1 | Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. | 5 | Conditional |
| CM.L2-3.4.2 | Establish and enforce security configuration settings for information technology products employed in organizational systems. | 5 | Conditional |
| CM.L2-3.4.3 | Track, review, approve, and log changes to organizational systems. | 1 | Yes |
| CM.L2-3.4.4 | Analyze the security impact of changes prior to implementation. | 1 | Yes |
| CM.L2-3.4.5 | Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. | 5 | Conditional |
| CM.L2-3.4.6 | Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. | 5 | Conditional |
| CM.L2-3.4.7 | Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. | 5 | Conditional |
| CM.L2-3.4.8 | Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. | 5 | Conditional |
| CM.L2-3.4.9 | Control and monitor user-installed software. | 1 | Yes |
Document and maintain hardware, software, and firmware baselines for every system in your CUI boundary. The Asset Inventory links each component to its approved configuration, satisfying 3.4.1 with auditable evidence.
Define and track security configuration settings for all IT products. The platform maps each setting to its hardening standard and flags deviations, covering 3.4.2 and 3.4.6 with continuous documentation.
Every system change flows through a tracked approval process with security impact analysis. The Change Control module captures the full lifecycle from request through implementation, satisfying 3.4.3, 3.4.4, and 3.4.5.
Maintain authorized software lists, enforce deny-by-exception policies, and monitor user-installed applications. The platform documents your software management approach for 3.4.7, 3.4.8, and 3.4.9 compliance.
These tools are commonly used by defense contractors to satisfy CM requirements. During your C3PAO assessment, you’ll document exactly which tools satisfy each control.
Assessors will ask for your baseline configuration documentation and verify it covers all CUI-handling systems. They’ll check change control procedures, look for evidence of unauthorized software controls, and verify that unnecessary services and ports are disabled. Expect questions about who approves configuration changes.
Configuration drift is invisible until an assessor finds it. Every undocumented change is a control gap waiting to fail your assessment.
1TEN gives your team the structure to govern CMMC compliance without building a compliance department around it.
Request a Demo