{"data":{"id":"CM-02","name":"Baseline Configuration","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and\nb. Review and update the baseline configuration of the system:\n1. [Assignment: organization-defined frequency];\n2. When required due to [Assignment: organization-defined circumstances]; and\n3. When system components are installed or upgraded.","supplemental_guidance":"Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.","enhancements":[{"id":"CM-02(01)","name":"Reviews and Updates","withdrawn":true,"incorporated_into":["CM-02"]},{"id":"CM-02(02)","name":"Automation Support for Accuracy and Currency","statement":"Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].","baselines":["moderate","high"]},{"id":"CM-02(03)","name":"Retention of Previous Configurations","statement":"Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback.","baselines":["moderate","high"]},{"id":"CM-02(04)","name":"Unauthorized Software","withdrawn":true,"incorporated_into":["CM-07(04)"]},{"id":"CM-02(05)","name":"Authorized Software","withdrawn":true,"incorporated_into":["CM-07(05)"]},{"id":"CM-02(06)","name":"Development and Test Environments","statement":"Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.","baselines":[]},{"id":"CM-02(07)","name":"Configure Systems and Components for High-risk Areas","statement":"a. Issue [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and\nb. Apply the following controls to the systems or components when the individuals return from travel: [Assignment: organization-defined controls].","baselines":["moderate","high"]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-02","name":"Baseline Configuration","description":"a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and\nb. Review and update the baseline configuration of the system:\n1. [Assignment: organization-defined frequency];\n2. When required due to [Assignment: organization-defined circumstances]; and\n3. When system components are installed or upgraded.","discussion":"Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.","related_controls":["AC-19","AU-06","CA-09","CM-01","CM-03","CM-05","CM-06","CM-08","CM-09","CP-09","CP-10","CP-12","MA-02","PL-08","PM-05","SA-08","SA-10","SA-15","SC-18"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Adds requirement to update baseline configuration document at organizationally-defined frequencies and for organizationally-defined circumstances (in addition to when changes are made) Incorporates withdrawn control CM-02(1)"}},"compliance_mappings":{"iso_27001_2022":["A.8.9"],"iso_27002_2022":["5.37","8.9","8.31"],"cobit_2019":["BAI10"],"pci_dss_v4":["1.2","1.2.1","2.1","2.2"],"nist_csf_2":["PR.PS-01"],"cis_controls_v8":["CIS 4","CIS 4.1","CIS 12","CIS 16.7"],"soc2_tsc":["CC6.1-POF7","CC6.7-POF1","CC7.1","CC7.1-POF1","CC8.1"],"finos_ccc":["CCC-C14"],"iso_42001_2023":["A.4.2","A.6.2.3"],"iec_62443":["3-3 SR 7.6"],"asd_e8":[],"nis2":["Art. 21(2)(g)"],"apra_cps_234":[],"mas_trm":["11"],"pra_op_resilience":[],"bsi_grundschutz":["NET.1.2","NET.3.1","SYS.1.1","SYS.2.1"],"anssi":["Hygiene.5","Hygiene.18","SecNumCloud.13.1"],"osfi_b13":["B-13.2.2"],"finma_circular":["IV.A(28)","IV.A(29)","IV.A(30)","IV.A(31)"],"gdpr":["Art.25(1)","Art.32(1)(b)"],"dora":["Art.7(1)","Art.9(1)"],"bio2":["5.37","8.9","8.31"],"rbi_csf":["Annex1.5"],"fisc":["FISC.O3","FISC.O13","FISC.T7","FISC.T14"],"lgpd_bcb":[],"hkma_tme1":["TME1.4.1","TME1.4.3"],"mlps_2":["8.1.9.5","8.1.10.4","8.1.10.6"],"dnb_good_practice":["DNB.3.2","DNB.10.3","DNB.10.5","DNB.13.1","DNB.13.2"],"cra":["CRA.I.2b","CRA.Info.3"],"swift_cscf":["SWIFT.2.3"],"cbb_tm":["TM-5"],"cbuae":["CR-7"],"nca_ecc":["2-3","5-1"],"qatar_nia":["OS","SD"],"sama_csf":["3.3","3.5","3.8","4.3"],"uae_ia":["T7"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.1","3.2"],"cbe_csf":["CTO-7","CTO-12"],"cbn_csf":["Part3.3"],"popia":["s19"],"sa_js2":["JS2-7.2"],"bcbs_239":["Principle 2"],"bot_cyber":["Ch2.1"],"cpmi_pfmi":["CG.PR","PFMI.P17"],"eba_ict":["3.4.4","3.5(a)"],"ecb_croe":["CROE.2.3.4"],"ffiec_is":["II.C.2","II.C.10"],"iosco_cyber":["ID-4"],"nydfs_500":["500.8"],"sebi_cscrf":["PR.IP"],"cmmc_2":["CM"],"nerc_cip":["CIP-010-4"],"nrc_73_54":["RG5.71-B-CM"],"tsa_psd":[],"ieee_1686":["5.4"],"ferc_cip":["Order 887"],"doe_c2m2":["ASSET"],"api_1164":["Sec 7"],"awia":["AWWA Sec 2"],"iaea_nss":["Sec 5.4"],"pci_pts":["K"],"fips_140":["FIPS 140-3 §7.6"],"cbest":[],"tiber_eu":[],"pci_hsm":["8"],"common_criteria":[],"isae_3402":["Clause 4","Clause 9"],"fca_sysc_13":["SYSC 13.7.1","SYSC 13.7.2"],"fda_21_cfr_11":["§11.10(f)"],"fda_cyber":["PU-2","SA-3"],"hitrust_csf":["09.a"],"iso_27799":["12.1"],"lloyds_ms":["MS8.4"],"naic_ds":["4-config","4B"],"nhs_dspt":["NDG-8.3"],"pra_ss1_23":["P3.3","P-IT.3"],"solvency_ii":["DR.266","EIOPA-ICT-4.8"],"owasp_masvs_v2":["MASVS-CODE-1","MASVS-CODE-2"],"csa_ccm_v4":["AIS-06","CCC-06","CCC-07","IVS-04","IVS-05","UEM-03","UEM-05","UEM-07"],"csa_aicm":["AIS-06","CCC-06","CCC-07","I&S-04","I&S-05","UEM-03","UEM-05","UEM-07"],"ccss_v9":[],"mica":["Art.62(5)"],"basel_sco60":["SCO60.14","SCO60.51","SCO60.65"],"bssc":["GSP-14","NOS-03"],"sec_custody_digital":["SEC-CD-08"],"dpdpa":[],"nist_ai_rmf_1":[],"eu_ai_act":[]},"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-008","SP-011","SP-012","SP-015","SP-017","SP-023","SP-025","SP-026","SP-028","SP-029","SP-030","SP-036","SP-037","SP-038","SP-041","SP-045","SP-046","SP-047","SP-049","SP-051","SP-053","SP-054"],"attack":{"techniques":285,"route":"/api/v1/controls/CM-02?fields=attack"}}}