03.04.01 Baseline configuration
Developing and keeping a current baseline configuration of the system under configuration control, reviewed at a defined frequency and whenever components are installed or modified.
03.04 Configuration management
Rev. 3 configuration management requirements: baselines, hardening settings, change control and impact analysis, least functionality, software allowlisting, component inventory, CUI location and devices for high-risk travel.
03.04.02 Configuration settings
Establishing, documenting and implementing the most restrictive configuration settings consistent with operations (hardening baselines), and identifying, documenting and approving any deviations.
03.04.03 Configuration change control
Defining which changes are configuration-controlled, reviewing and approving them with security impacts considered, implementing and documenting approved changes, and monitoring change activity.
03.04.04 Impact analyses
Analyzing the security impact of system changes before they are implemented and verifying afterwards that the security requirements are still satisfied.
03.04.05 Access restrictions for change
Defining, documenting, approving and enforcing the physical and logical access restrictions that limit who can make changes to the system.
03.04.06 Least functionality
Configuring the system for mission-essential capabilities only, prohibiting or restricting defined functions, ports, protocols, connections and services, and reviewing for and removing unnecessary or nonsecure ones. Rev. 3 folded Rev. 2's 3.4.7 into it.
03.04.08 Authorized software: allow by exception
Application allowlisting: identifying the software authorized to run, enforcing a deny-all, allow-by-exception execution policy and reviewing the authorized list at a defined frequency.
03.04.10 System component inventory
Developing and maintaining an inventory of system components, reviewed at a defined frequency and updated with installations, removals and system updates; a separate requirement for the first time in Rev. 3.
03.04.11 Information location
Identifying and documenting where CUI is processed and stored and on which system components, and documenting changes to those locations; new in Rev. 3.
03.04.12 System and component configuration for high-risk areas
Issuing specially configured systems or components to people traveling to high-risk locations and applying defined security measures to those devices when the travelers return; new in Rev. 3.
