CM-2 Baseline configuration
Requires a current baseline configuration of the system to be developed, documented and held under configuration control, and reviewed and updated on a defined frequency, when defined circumstances require it, and whenev
4
artefacts
2
held by a system
1
at each review
easy
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Documented baseline configuration for each component type in the system · Cloud console / configuration management
- Version control or configuration management repository showing baseline change history · Source control / CI pipeline
periodic reviewEvidence produced at each review
- Review records at the defined frequency and after component installation or upgrade · Cloud console / configuration management
governing documentDocuments that govern the control
- Comparison of a deployed instance against its baseline · Policy repository / GRC workspace
First move
Automate the pull from your Cloud console / configuration management. Configuration snapshots and change history from the cloud console or IaC repository, diffed against the baseline.
Common gaps auditors find
- Baseline exists for servers but not for network devices, containers or cloud services
- Baseline document frozen at deployment while live systems drifted
- Baselines updated informally without passing through configuration control
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCM-1 Policy and procedures for configuration management · CM-3 Configuration change control