CCI-000296

The organization reviews and updates the baseline configuration of the information system at an organization-defined frequency.

Implementation Guidance

The organization being inspected/assessed reviews and updates the baseline configuration of the information system annually. The organization must document each occurrence of the reviews and update actions as an audit trail. DoD has defined the frequency as annually.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines documentation of organizational reviews and update actions for the baseline configuration to ensure annual review and necessary updates are occurring. DoD has defined the frequency as annually.

Compelling Evidence

1.) Baseline configuration of the information system (hardware and software list) with change log referenced

The controls below (if any) were marked by NIST as being related to CCI-000296.