NIST SP 800-171 & CMMC 2.0 Control 3.4.1 Requirement:

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

NIST SP 800-171 & CMMC 2.0 3.4.1 Requirement Explanation:

Baseline configurations are documented, formally reviewed, and agreed-upon sets of specifications for systems. Baseline configurations serve as a basis for future builds, releases, and changes to systems. A documented baseline configuration establishes how a system should be configured. Baseline configurations should be designed based on the principle of least functionality.

Example NIST SP 800-171 & CMMC 2.0 3.4.1 Implementation:

Create baseline configurations for each type of system used in your company. Baseline configurations specify how a particular device such as a Windows computer should be configured. This includes documenting the default software to be installed on a system and it's security settings. You need to establish baseline configurations for computers, servers, network devices, and printers. Periodically update your baseline configurations to reflect any new operational requirements. Maintain a list of all hardware systems (workstations, servers, network devices, printers, etc.) used in your company. Maintain a list of all software used on your systems.

NIST SP 800-171 & CMMC 2.0 3.4.1 Scenario(s):

- Scenario 1:

Alice a system administrator has established a baseline configuration for her company's Windows computers. She documents the software to be installed on them and which DISA STIG security settings to apply to the system. Every time she configures a Windows workstation she follows her established baseline configuration.

Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:


Compliance Accelerator

Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.

Quantum Assessor

Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.

Supply Chain Verifier

Trust is everything. Verify, monitor, and support subcontactor compliance.