CM.L2-3.4.1
System Baselining
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CM.L2-3.4.1 in the reference catalog with its NIST cross-references
Official requirement
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
Assessment objectives
a. a baseline configuration is established;
b. the baseline configuration includes hardware, software, firmware, and documentation;
c. the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle;
d. a system inventory is established;
e. the system inventory includes hardware, software, firmware, and documentation; and
f. the inventory is maintained (reviewed and updated) throughout the system development life cycle.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Maintain baseline configurations and inventories throughout the system life cycle.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of upgrading the computer operating systems of your office’ s computers. Some of these computers process, store, or transmit CUI. You research how to set up and configure a workstation with the least functionality and highest security and use that as the framework for creating a configuration that minimizes functionality while still allowing users to do their tasks. After testing the new baseline on a single workstation, you document this configuration and apply it to the other computers [a]. You then check to make sure that the software changes are accurately reflected in your master system inventory [e]. Finally, you set a calendar reminder to review the baseline in three months [f].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Configuration management policy; procedures addressing the baseline configuration of the system; procedures addressing system inventory; system security plan; configuration management plan; system inventory records; inventory review and update records; enterprise architecture documentation; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; change control records; system component installation records; system component removal records; other relevant documents or records
Common mistakes
Keeping an inventory that no longer matches deployed hardware, software, and firmware.