03.04.01: Baseline Configuration

Discussion:

Baseline configurations for the system and system components include aspects of connectivity, operation, and communications. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for the system or configuration items within the system. Baseline configurations serve as a basis for future builds, releases, or changes to the system and include information about system components, operational procedures, network topology, and the placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as the system changes over time. Baseline configurations of the system reflect the current enterprise architecture.

Assessment Methods and Objectives

Examine [SELECT FROM: configuration management policy and procedures; procedures for the baseline system configuration; configuration management plan; enterprise architecture; system design documentation; system architecture; system configuration settings; system component inventory; change control records; system security plan; other relevant documents or records]

Interview [SELECT FROM: personnel with configuration management responsibilities; personnel with information security responsibilities; system administrators]

Test [SELECT FROM: processes for managing baseline configurations; mechanisms for supporting configuration control of the baseline configuration]