---
title: "NIST 800-171 3.4 Configuration Management"
description: "The 9 NIST SP 800-171 Configuration Management requirements (3.4, CMMC CM): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/configuration-management
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/configuration-management
records: 4
digest: sha3:f9030ad737e26a3e01c71bfa0b414f059d829d4845482e5f22ab04fa4b2e6a15
---

# NIST 800-171 3.4 Configuration Management

NIST 800-171 / Configuration Management

Configuration Management keeps the system in a known state: documented baselines and inventories, enforced security settings, changes reviewed before they happen, and only the software and services the mission needs.

9 requirements · up to 33 SPRS points · 3 can go on a CMMC POA&M

## The 9 Configuration Management requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.4.1 Baseline and Inventory](https://policycortex.com/nist-800-171/configuration-management/3.4.1) | CM.L2-3.4.1 | 5 points | Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. |
| [3.4.2 Security Settings](https://policycortex.com/nist-800-171/configuration-management/3.4.2) | CM.L2-3.4.2 | 5 points | Establish and enforce security configuration settings for information technology products employed in organizational systems. |
| [3.4.3 Change Control](https://policycortex.com/nist-800-171/configuration-management/3.4.3) | CM.L2-3.4.3 | 1 point | Track, review, approve or disapprove, and log changes to organizational systems. |
| [3.4.4 Security Impact Analysis](https://policycortex.com/nist-800-171/configuration-management/3.4.4) | CM.L2-3.4.4 | 1 point | Analyze the security impact of changes prior to implementation. |
| [3.4.5 Change Access Limits](https://policycortex.com/nist-800-171/configuration-management/3.4.5) | CM.L2-3.4.5 | 5 points | Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. |
| [3.4.6 Least Functionality](https://policycortex.com/nist-800-171/configuration-management/3.4.6) | CM.L2-3.4.6 | 5 points | Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. |
| [3.4.7 Nonessential Services](https://policycortex.com/nist-800-171/configuration-management/3.4.7) | CM.L2-3.4.7 | 5 points | Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. |
| [3.4.8 Application Execution](https://policycortex.com/nist-800-171/configuration-management/3.4.8) | CM.L2-3.4.8 | 5 points | Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. |
| [3.4.9 User-Installed Software](https://policycortex.com/nist-800-171/configuration-management/3.4.9) | CM.L2-3.4.9 | 1 point | Control and monitor user-installed software. |

## Configuration Management: points and the CMMC POA&M

**Q: How many SPRS points can the Configuration Management family cost?**
A: Up to 33 of the 313 points a score can lose: 6 worth 5 points and 3 worth 1.

**Q: Which Configuration Management requirements can go on a CMMC POA&M?**
A: 3 of the 9: 3.4.3, 3.4.4 and 3.4.9, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Configuration Management requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-CM)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.3 Audit and Accountability](https://policycortex.com/nist-800-171/audit-and-accountability)
- **Next family**: [3.5 Identification and Authentication](https://policycortex.com/nist-800-171/identification-and-authentication)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | dca96aede3ae | 78d57c539c21 |
| REC 0001 | REQUIREMENTS | 9a613f0e816f | dca96aede3ae |
| REC 0002 | POINTS AND POA&M | 0838943b9cc8 | 9a613f0e816f |
| REC 0003 | RELATED | f9030ad737e2 | 0838943b9cc8 |

Head sha3:f9030ad737e26a3e01c71bfa0b414f059d829d4845482e5f22ab04fa4b2e6a15. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.