THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · CM-2

Baseline Configuration

US National Institute of Standards and Technology (NIST) · cited in 100 of our lessons

Explanation

What it asks for. The organisation must develop, document and maintain a current baseline configuration of the system under configuration control, and review and update it at defined times and when components change.

In practice. This means version-controlled build standards or infrastructure-as-code templates describing approved configurations, software versions and network settings. Changes to the baseline go through change management and deployed systems are compared against it. Auditors expect baseline documents or code, change history and drift reports. CIS Control 4 and ISO/IEC 27001 configuration management carry the same idea. Keeping previous baselines supports rollback and investigation.

Common gaps. Baselines are often written once and not updated, so they no longer match reality. Systems built manually outside the standard process create unknown configurations. Cloud resources changed directly in consoles also drift away from their templates.

Open SP 800-53 at NIST
The official text
a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: organization-defined frequency]; 2. When required due to [Assignment: organization-defined circumstances] ; and 3. When system components are installed or upgraded. Discussion: Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 100.