CM.L2-3.4.2
Security Configuration Enforcement
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CM.L2-3.4.2 in the reference catalog with its NIST cross-references
Official requirement
Establish and enforce security configuration settings for information technology products employed in organizational systems.
Assessment objectives
a. security configuration settings for information technology products employed in the system are established and included in the baseline configuration; and
b. security configuration settings for information technology products employed in the system are enforced.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Define and enforce secure configuration settings for the technology you use.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You manage baseline configurations for your company’s systems, including those that process, store, and transmit CUI. As part of this, you download a secure configuration guide for each of your asset types (servers, workstations, network components, operating systems, middleware, and applications) from a well-known and trusted IT security organization. You then apply all of the settings that you can while still ensuring the assets can perform the role for which they are needed. Once you have the configuration settings identified and tested, you document them to ensure all applicable machines can be configured the same way [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Configuration management policy; baseline configuration; procedures addressing configuration settings for the system; configuration management plan; system security plan; system design documentation; system configuration settings and associated documentation; security configuration checklists; evidence supporting approved deviations from established configuration settings; change control records; system audit logs and records; other relevant documents or records
Common mistakes
Documenting a baseline without applying it or checking for drift.