CM-02 Baseline Configuration
Configuration Management
Low Moderate High
Description
a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: organization-defined frequency]; 2. When required due to [Assignment: organization-defined circumstances]; and 3. When system components are installed or upgraded.
Supplemental Guidance
Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.
Changes from Rev 4
Adds requirement to update baseline configuration document at organizationally-defined frequencies and for organizationally-defined circumstances (in addition to when changes are made) Incorporates withdrawn control CM-02(1)
Enhancements (4)
What NIST adds to this control. Select one to read its statement.
CM-02(02) Automation Support for Accuracy and Currency ModerateHigh
Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].
CM-02(03) Retention of Previous Configurations ModerateHigh
Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback.
CM-02(06) Development and Test Environments
Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.
CM-02(07) Configure Systems and Components for High-risk Areas ModerateHigh
a. Issue [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and b. Apply the following controls to the systems or components when the individuals return from travel: [Assignment: organization-defined controls].
Patterns that use this control (23)
Grouped by the emphasis each pattern gives it.
Critical (11)
- SP-001 Client Module
- SP-002 Server Module
- SP-008 Public Web Server Pattern
- SP-011 Cloud Computing Pattern
- SP-015 Secure Remote Working
- SP-023 Industrial Control Systems
- SP-025 Advanced Monitoring and Detection
- SP-026 PCI Full Environment
- SP-028 Secure DevOps Pipeline Pattern
- SP-045 AI Governance and Responsible AI
- SP-049 AI in Security Operations (draft)
Important (10)
- SP-012 Secure Software Development Lifecycle
- SP-017 Secure Network Zone Module
- SP-029 Zero Trust Architecture
- SP-030 API Security
- SP-036 Incident Response
- SP-037 Privileged User Management
- SP-038 Vulnerability Management and Patching
- SP-046 External Attack Surface Management
- SP-047 Secure Agentic AI Frameworks
- SP-054 CBDC and Digital Currency Infrastructure (draft)
MITRE ATT&CK Techniques (285)
ATT&CK v20.0Techniques this control mitigates in the CTID mapping of SP 800-53, made for ATT&CK 16.1 and carried to v20.0. See them all in the ATT&CK matrix.
Reconnaissance 3 Initial Access 8 Execution 40 Persistence 53 Privilege Escalation 35 Stealth 53 Defense Impairment 26 Credential Access 39 Discovery 4 Lateral Movement 17 Collection 19 Command and Control 31 Exfiltration 10 Impact 13
Show all 285 techniques grouped by tactic
Reconnaissance
Initial Access
Execution
T1047 Windows Management Instrumentation T1053 Scheduled Task/Job T1053.002 At T1053.003 Cron T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.002 AppleScript T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1059.008 Network Device CLI T1059.010 AutoHotKey & AutoIT T1059.011 Lua T1072 Software Deployment Tools T1106 Native API T1127 Trusted Developer Utilities Proxy Execution T1127.001 MSBuild T1127.002 ClickOnce T1129 Shared Modules T1204 User Execution T1204.001 Malicious Link T1204.002 Malicious File T1204.003 Malicious Image T1559 Inter-Process Communication T1559.001 Component Object Model T1559.002 Dynamic Data Exchange T1569 System Services T1569.002 Service Execution T1574 Hijack Execution Flow T1574.001 DLL T1574.004 Dylib Hijacking T1574.005 Executable Installer File Permissions Weakness T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.010 Services File Permissions Weakness T1574.013 KernelCallbackTable
Persistence
T1037 Boot or Logon Initialization Scripts T1037.002 Login Hook T1037.003 Network Logon Script T1037.004 RC Scripts T1037.005 Startup Items T1053 Scheduled Task/Job T1053.002 At T1053.003 Cron T1053.005 Scheduled Task T1098.004 SSH Authorized Keys T1133 External Remote Services T1137 Office Application Startup T1137.001 Office Template Macros T1137.002 Office Test T1137.003 Outlook Forms T1137.004 Outlook Home Page T1137.005 Outlook Rules T1137.006 Add-ins T1176 Software Extensions T1205 Traffic Signaling T1505 Server Software Component T1505.001 SQL Stored Procedures T1505.002 Transport Agent T1505.003 Web Shell T1505.004 IIS Components T1505.005 Terminal Services DLL T1525 Implant Internal Image T1542 Pre-OS Boot T1542.003 Bootkit T1542.004 ROMMONkit T1542.005 TFTP Boot T1543 Create or Modify System Process T1543.001 Launch Agent T1543.002 Systemd Service T1543.003 Windows Service T1543.004 Launch Daemon T1546 Event Triggered Execution T1546.002 Screensaver T1546.003 Windows Management Instrumentation Event Subscription T1546.004 Unix Shell Configuration Modification T1546.006 LC_LOAD_DYLIB Addition T1546.010 AppInit DLLs T1546.013 PowerShell Profile T1546.014 Emond T1547.003 Time Providers T1547.007 Re-opened Applications T1547.008 LSASS Driver T1547.013 XDG Autostart Entries T1554 Compromise Host Software Binary T1556 Modify Authentication Process T1556.004 Network Device Authentication T1556.008 Network Provider DLL T1653 Power Settings
Privilege Escalation
T1037 Boot or Logon Initialization Scripts T1037.002 Login Hook T1037.003 Network Logon Script T1037.004 RC Scripts T1037.005 Startup Items T1053 Scheduled Task/Job T1053.002 At T1053.003 Cron T1053.005 Scheduled Task T1068 Exploitation for Privilege Escalation T1098.004 SSH Authorized Keys T1134.005 SID-History Injection T1484 Domain or Tenant Policy Modification T1543 Create or Modify System Process T1543.001 Launch Agent T1543.002 Systemd Service T1543.003 Windows Service T1543.004 Launch Daemon T1546 Event Triggered Execution T1546.002 Screensaver T1546.003 Windows Management Instrumentation Event Subscription T1546.004 Unix Shell Configuration Modification T1546.006 LC_LOAD_DYLIB Addition T1546.010 AppInit DLLs T1546.013 PowerShell Profile T1546.014 Emond T1547.003 Time Providers T1547.007 Re-opened Applications T1547.008 LSASS Driver T1547.013 XDG Autostart Entries T1548 Abuse Elevation Control Mechanism T1548.002 Bypass User Account Control T1548.003 Sudo and Sudo Caching T1548.004 Elevated Execution with Prompt T1548.006 TCC Manipulation
Stealth
T1027 Obfuscated Files or Information T1036 Masquerading T1036.001 Invalid Code Signature T1036.003 Rename Legitimate Utilities T1036.005 Match Legitimate Resource Name or Location T1036.007 Double File Extension T1070 Indicator Removal T1070.003 Clear Command History T1070.007 Clear Network Connection History and Configurations T1070.008 Clear Mailbox Data T1070.009 Clear Persistence T1127 Trusted Developer Utilities Proxy Execution T1127.001 MSBuild T1127.002 ClickOnce T1134.005 SID-History Injection T1205 Traffic Signaling T1211 Exploitation for Stealth T1216 System Script Proxy Execution T1216.001 PubPrn T1216.002 SyncAppvPublishingServer T1218 System Binary Proxy Execution T1218.001 Compiled HTML File T1218.002 Control Panel T1218.003 CMSTP T1218.004 InstallUtil T1218.005 Mshta T1218.007 Msiexec T1218.008 Odbcconf T1218.009 Regsvcs/Regasm T1218.012 Verclsid T1218.013 Mavinject T1218.014 MMC T1218.015 Electron Applications T1220 XSL Script Processing T1221 Template Injection T1542 Pre-OS Boot T1542.003 Bootkit T1542.004 ROMMONkit T1542.005 TFTP Boot T1564.006 Run Virtual Instance T1564.007 VBA Stomping T1564.009 Resource Forking T1574 Hijack Execution Flow T1574.001 DLL T1574.004 Dylib Hijacking T1574.005 Executable Installer File Permissions Weakness T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.010 Services File Permissions Weakness T1574.013 KernelCallbackTable T1612 Build Image on Host T1622 Debugger Evasion
Defense Impairment
T1484 Domain or Tenant Policy Modification T1553 Subvert Trust Controls T1553.001 Gatekeeper Bypass T1553.003 SIP and Trust Provider Hijacking T1553.005 Mark-of-the-Web Bypass T1553.006 Code Signing Policy Modification T1556 Modify Authentication Process T1556.004 Network Device Authentication T1556.008 Network Provider DLL T1578 Modify Cloud Compute Infrastructure T1578.001 Create Snapshot T1578.002 Create Cloud Instance T1578.003 Delete Cloud Instance T1599 Network Boundary Bridging T1599.001 Network Address Translation Traversal T1601 Modify System Image T1601.001 Patch System Image T1601.002 Downgrade System Image T1647 Plist File Modification T1685 Disable or Modify Tools T1685.001 Disable or Modify Windows Event Log T1685.005 Clear Windows Event Logs T1685.006 Clear Linux or Mac System Logs T1686 Disable or Modify System Firewall T1689 Downgrade Attack T1690 Prevent Command History Logging
Credential Access
T1003 OS Credential Dumping T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1003.004 LSA Secrets T1003.005 Cached Domain Credentials T1003.006 DCSync T1003.007 Proc Filesystem T1003.008 /etc/passwd and /etc/shadow T1110 Brute Force T1110.001 Password Guessing T1110.002 Password Cracking T1110.003 Password Spraying T1110.004 Credential Stuffing T1111 Multi-Factor Authentication Interception T1187 Forced Authentication T1212 Exploitation for Credential Access T1528 Steal Application Access Token T1539 Steal Web Session Cookie T1552 Unsecured Credentials T1552.001 Credentials In Files T1552.002 Credentials in Registry T1552.004 Private Keys T1552.006 Group Policy Preferences T1555.004 Windows Credential Manager T1555.005 Password Managers T1556 Modify Authentication Process T1556.004 Network Device Authentication T1556.008 Network Provider DLL T1557 Adversary-in-the-Middle T1557.001 Name Resolution Poisoning and SMB Relay T1557.002 ARP Cache Poisoning T1557.003 DHCP Spoofing T1557.004 Evil Twin T1558 Steal or Forge Kerberos Tickets T1558.001 Golden Ticket T1558.002 Silver Ticket T1558.003 Kerberoasting T1558.004 AS-REP Roasting
Discovery
Lateral Movement
T1021 Remote Services T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.003 Distributed Component Object Model T1021.004 SSH T1021.005 VNC T1021.006 Windows Remote Management T1072 Software Deployment Tools T1080 Taint Shared Content T1091 Replication Through Removable Media T1210 Exploitation of Remote Services T1550.001 Application Access Token T1550.003 Pass the Ticket T1563 Remote Service Session Hijacking T1563.001 SSH Hijacking T1563.002 RDP Hijacking T1570 Lateral Tool Transfer
Collection
T1114 Email Collection T1114.002 Remote Email Collection T1119 Automated Collection T1185 Browser Session Hijacking T1213 Data from Information Repositories T1213.001 Confluence T1213.002 Sharepoint T1213.005 Messaging Applications T1530 Data from Cloud Storage T1557 Adversary-in-the-Middle T1557.001 Name Resolution Poisoning and SMB Relay T1557.002 ARP Cache Poisoning T1557.003 DHCP Spoofing T1557.004 Evil Twin T1560 Archive Collected Data T1560.001 Archive via Utility T1602 Data from Configuration Repository T1602.001 SNMP (MIB Dump) T1602.002 Network Device Configuration Dump
Command and Control
T1001 Data Obfuscation T1001.001 Junk Data T1001.002 Steganography T1001.003 Protocol or Service Impersonation T1008 Fallback Channels T1071 Application Layer Protocol T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.003 Mail Protocols T1071.004 DNS T1090 Proxy T1090.001 Internal Proxy T1090.002 External Proxy T1092 Communication Through Removable Media T1095 Non-Application Layer Protocol T1102 Web Service T1102.001 Dead Drop Resolver T1102.002 Bidirectional Communication T1102.003 One-Way Communication T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1132 Data Encoding T1132.001 Standard Encoding T1132.002 Non-Standard Encoding T1205 Traffic Signaling T1219 Remote Access Tools T1571 Non-Standard Port T1572 Protocol Tunneling T1573 Encrypted Channel T1573.001 Symmetric Cryptography T1573.002 Asymmetric Cryptography
Exfiltration
T1011.001 Exfiltration Over Bluetooth T1020.001 Traffic Duplication T1029 Scheduled Transfer T1030 Data Transfer Size Limits T1048 Exfiltration Over Alternative Protocol T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1052 Exfiltration Over Physical Medium T1052.001 Exfiltration over USB
Impact
T1485 Data Destruction T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1491 Defacement T1491.001 Internal Defacement T1491.002 External Defacement T1495 Firmware Corruption T1561 Disk Wipe T1561.001 Disk Content Wipe T1561.002 Disk Structure Wipe T1565 Data Manipulation T1565.001 Stored Data Manipulation T1565.002 Transmitted Data Manipulation
Compliance Mappings
ISO 27001:2022
A.8.9
ISO 27002:2022
5.378.98.31
COBIT 2019
BAI10
CIS Controls v8
CIS 4CIS 4.1CIS 12CIS 16.7
NIST CSF 2.0
PR.PS-01
SOC 2 TSC
CC6.1-POF7CC6.7-POF1CC7.1CC7.1-POF1CC8.1
PCI DSS v4.0.1
1.21.2.12.12.2
CSA CCM v4
AIS-06CCC-06CCC-07IVS-04IVS-05UEM-03UEM-05UEM-07
CSA AICM v1
AIS-06CCC-06CCC-07I&S-04I&S-05UEM-03UEM-05UEM-07
FINOS CCC
CCC-C14
ISO 42001:2023
A.4.2A.6.2.3
IEC 62443
3-3 SR 7.6
NIS2 Directive
Art. 21(2)(g)
MAS TRM
11
BSI IT-Grundschutz
NET.1.2NET.3.1SYS.1.1SYS.2.1
ANSSI
Hygiene.5Hygiene.18SecNumCloud.13.1
FINMA Circular 2023/1
IV.A(28)IV.A(29)IV.A(30)IV.A(31)
OSFI B-13
B-13.2.2
EU GDPR
Art.25(1)Art.32(1)(b)
EU DORA
Art.7(1)Art.9(1)
BIO2
5.378.98.31
RBI CSF
Annex1.5
FISC Security Guidelines
FISC.O3FISC.O13FISC.T7FISC.T14
HKMA TM-E-1
TME1.4.1TME1.4.3
MLPS 2.0
8.1.9.58.1.10.48.1.10.6
DNB Good Practice
DNB.3.2DNB.10.3DNB.10.5DNB.13.1DNB.13.2
EU CRA
CRA.I.2bCRA.Info.3
SWIFT CSCF
SWIFT.2.3
SAMA CSF
3.33.53.84.3
NCA ECC
2-35-1
UAE IA
T7
CBB TM
TM-5
Qatar NIA
OSSD
CBUAE
CR-7
CBE CSF
CTO-7CTO-12
SA JS2
JS2-7.2
CBN CSF
Part3.3
BoG CISD
CISD-VI
POPIA
s19
BoM CTRM
3.13.2
IOSCO Cyber Resilience
ID-4
BCBS 239
Principle 2
CPMI-IOSCO PFMI
CG.PRPFMI.P17
FFIEC IS
II.C.2II.C.10
NYDFS 500
500.8
ECB CROE
CROE.2.3.4
EBA ICT Guidelines
3.4.43.5(a)
SEBI CSCRF
PR.IP
BOT Cyber Resilience
Ch2.1
CMMC 2.0
CM
NERC CIP
CIP-010-4
10 CFR 73.54
RG5.71-B-CM
IEEE 1686-2022
5.4
FERC CIP Orders
Order 887
DOE C2M2 v2.1
ASSET
API 1164
Sec 7
AWIA
AWWA Sec 2
IAEA NSS 17-T
Sec 5.4
PCI PTS v6
K
FIPS 140-3
FIPS 140-3 §7.6
PCI HSM
8
ISAE 3402
Clause 4Clause 9
Solvency II
DR.266EIOPA-ICT-4.8
Lloyd's Minimum Standards
MS8.4
NAIC Insurance Data Security
4-config4B
PRA SS1/23
P3.3P-IT.3
FCA SYSC 13
SYSC 13.7.1SYSC 13.7.2
HITRUST CSF v11
09.a
FDA 21 CFR Part 11
§11.10(f)
FDA Cybersecurity Guidance
PU-2SA-3
ISO 27799
12.1
NHS DSPT
NDG-8.3
OWASP MASVS v2.1
MASVS-CODE-1MASVS-CODE-2
MiCA
Art.62(5)
Basel SCO60
SCO60.14SCO60.51SCO60.65
BSSC Standards
GSP-14NOS-03
SEC Custody (Digital Assets)
SEC-CD-08
ISO 17799 (legacy)
7.1.115.1.2
COBIT 4.1 (legacy)
PO1.6PO2.1DS9.1