CM.L2-3.4.1 System baselining
Establishing and maintaining baseline configurations and inventories covering hardware, software, firmware and documentation across the system life cycle. A 5-point requirement that other CM requirements build on.
CM Configuration management
The nine CMMC Level 2 configuration management requirements: baselines and inventories, secure settings, change control and impact analysis, least functionality, application allow or deny lists, and user-installed software.
CM.L2-3.4.2 Security configuration enforcement
Establishing security configuration settings for each IT product, including them in the baseline, and enforcing them, with reviewed and approved deviations. Covers hardening checklists, drift detection and evidence.
CM.L2-3.4.3 System change management
Tracking, reviewing, approving or rejecting, and logging changes to organizational systems, typically through a change control board. Covers change records, approval evidence and how changes connect to the SSP.
CM.L2-3.4.4 Security impact analysis
Analyzing the security impact of each change before it is implemented. The DoW treats this analysis as the first test of whether a change is significant enough to affect CMMC compliance.
CM.L2-3.4.5 Access restrictions for change
Defining, documenting, approving and enforcing both the physical and the logical access restrictions on who can change systems, such as server room key cards, change credentials and change windows.
CM.L2-3.4.6 Least functionality
Configuring systems to provide only essential capabilities, removing default utilities and disabling unneeded services. Covers defining essential capabilities, hardening evidence and assessor tests.
CM.L2-3.4.7 Nonessential functionality
Restricting, disabling or preventing nonessential programs, functions, ports, protocols and services. With 15 assessment objectives, it has more than any other Level 2 requirement.
CM.L2-3.4.8 Application execution policy
Choosing a deny-by-exception (blacklisting) or permit-by-exception (whitelisting) policy for software execution and implementing it, with authorized or unauthorized software lists kept current.
CM.L2-3.4.9 User-installed software
Setting a policy for software installation by users, enforcing it, and monitoring what users install. Covers installation rights, approval routes and monitoring evidence.
