CCI-003910

Review and update the baseline configuration of the system when system components are installed or upgraded.

Implementation Guidance

Determine if the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; enterprise architecture documentation; system design documentation; system security plan; privacy plan; system architecture and configuration documentation; system configuration settings and associated documentation; system component inventory; change control records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with configuration management responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for managing baseline configurations; mechanisms supporting configuration control of the baseline configuration].

The controls below (if any) were marked by NIST as being related to CCI-003910.