NIST 800-171 3.4.1 (CM.L2-3.4.1): Baseline and Inventory

What 3.4.1 means in practice

Write down how each kind of system should be built (the baseline) and keep a current inventory of hardware, software, firmware and documentation. Both are kept up to date as systems change, so an assessor can compare what exists with what was approved.

SPRS points and the CMMC POA&M

What an assessor checks for 3.4.1

NIST SP 800-171A gives 6 determination statements for 3.4.1, each found satisfied or other than satisfied. Determine if:

1. 3.4.1[a] a baseline configuration is established.
2. 3.4.1[b] the baseline configuration includes hardware, software, firmware, and documentation.
3. 3.4.1[c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle.
4. 3.4.1[d] a system inventory is established.
5. 3.4.1[e] the system inventory includes hardware, software, firmware, and documentation.
6. 3.4.1[f] the inventory is maintained (reviewed and updated) throughout the system development life cycle.

NIST SP 800-171A (June 2018), assessment objectives for 3.4.1

Evidence that shows 3.4.1 is met

• Documented baseline configurations for each system type.
• A current inventory of hardware, software and firmware, with owners.
• Records showing the baseline and the inventory were reviewed and updated.
• A comparison of deployed systems against the baseline, such as a policy compliance report.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.4.1 from it. Each line says what the product checks.

• Azure Policy: Assignments. Checks that Azure Policy assignments enforce baseline configurations and that few resources are out of compliance with them.