NIST SP 800-171 REV. 3 Configuration Management

• 03.04.01 Baseline Configuration

  Develop and maintain under configuration control, a current baseline configuration of the system.

• 03.04.02 Configuration Settings

  Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: [Assignment: organization-defined configuration settings].

• 03.04.03 Configuration Change Control

  Define the types of changes to the system that are configuration-controlled.

• 03.04.04 Impact Analyses

  Analyze changes to the system to determine potential security impacts prior to change implementation.

• 03.04.05 Access Restrictions for Change

  Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

• 03.04.06 Least Functionality

  Configure the system to provide only mission-essential capabilities.

• 03.04.08 Authorized Software – Allow by Exception

  Identify software programs authorized to execute on the system.

• 03.04.10 System Component Inventory

  Develop and document an inventory of system components.

• 03.04.11 Information Location

  Identify and document the location of CUI and the system components on which the information is processed and stored.

• 03.04.12 System and Component Configuration for High-Risk Areas

  Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [Assignment: organization-defined system configurations].

Need help putting this into practice? See our NIST SP 800-171 & CMMC compliance services or read our NIST SP 800-171 & CMMC articles.