---
title: "NIST 800-171 3.4.1 (CM.L2-3.4.1): Baseline and Inventory"
description: "NIST SP 800-171 3.4.1 Baseline and Inventory: 5 SPRS points, not allowed on a CMMC POA&M. The text, what assessors check and the evidence."
url: https://policycortex.com/nist-800-171/configuration-management/3.4.1
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/configuration-management/3.4.1
records: 7
digest: sha3:0cd15dfeb55d9b103ddb9955560c930b68040e1c9c54a8c48b2a5a9ae057d3f7
---

# NIST 800-171 3.4.1 (CM.L2-3.4.1): Baseline and Inventory

NIST 800-171 / Configuration Management / 3.4.1

"Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles." ([NIST SP 800-171 Rev. 2, requirement 3.4.1](https://doi.org/10.6028/NIST.SP.800-171r2))

CMMC Level 2 practice CM.L2-3.4.1.

## What 3.4.1 means in practice

Write down how each kind of system should be built (the baseline) and keep a current inventory of hardware, software, firmware and documentation. Both are kept up to date as systems change, so an assessor can compare what exists with what was approved.

## SPRS points and the CMMC POA&M

- **CMMC Level 2 practice**: CM.L2-3.4.1
- **SPRS points**: 5 points. When it is not met, the DoD Assessment Methodology subtracts 5 from the score of 110.
- **CMMC POA&M**: Not allowed. It is worth 5 points, and 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point, with one exception: 3.13.11 when encryption is used but not FIPS validated.

Sources: [NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A](https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf); [32 CFR 170.21, Plan of Action and Milestones requirements](https://www.ecfr.gov/current/title-32/section-170.21).

## What an assessor checks for 3.4.1

NIST SP 800-171A gives 6 determination statements for 3.4.1, each found satisfied or other than satisfied. Determine if:

- 3.4.1[a] a baseline configuration is established.
- 3.4.1[b] the baseline configuration includes hardware, software, firmware, and documentation.
- 3.4.1[c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle.
- 3.4.1[d] a system inventory is established.
- 3.4.1[e] the system inventory includes hardware, software, firmware, and documentation.
- 3.4.1[f] the inventory is maintained (reviewed and updated) throughout the system development life cycle.

[NIST SP 800-171A (June 2018), assessment objectives for 3.4.1](https://doi.org/10.6028/NIST.SP.800-171A)

## Evidence that shows 3.4.1 is met

- Documented baseline configurations for each system type.
- A current inventory of hardware, software and firmware, with owners.
- Records showing the baseline and the inventory were reviewed and updated.
- A comparison of deployed systems against the baseline, such as a policy compliance report.

## How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.4.1 from it. Each line says what the product checks.

- **Azure Policy: Assignments.** Checks that Azure Policy assignments enforce baseline configurations and that few resources are out of compliance with them.

## Related pages

- **Calculator**: [SPRS score calculator: mark 3.4.1 and the other 109 requirements and see the score.](https://policycortex.com/sprs-score-calculator#family-CM)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Family**: [All 9 Configuration Management requirements (3.4).](https://policycortex.com/nist-800-171/configuration-management)
- **Previous**: [3.3.9: Audit Management](https://policycortex.com/nist-800-171/audit-and-accountability/3.3.9)
- **Next**: [3.4.2: Security Settings](https://policycortex.com/nist-800-171/configuration-management/3.4.2)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Meet the requirement once. Keep the evidence current. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | REQUIREMENT | 0488b2e401a3 | 23b00bd7f526 |
| REC 0001 | MEANING | fdb3cd3234c1 | 0488b2e401a3 |
| REC 0002 | POINTS AND POA&M | e0ce6eaed5a7 | fdb3cd3234c1 |
| REC 0003 | ASSESSMENT OBJECTIVES | 01c23f1bee69 | e0ce6eaed5a7 |
| REC 0004 | EVIDENCE | 079145726b6f | 01c23f1bee69 |
| REC 0005 | COLLECTORS | bd0698f62561 | 079145726b6f |
| REC 0006 | RELATED | 0cd15dfeb55d | bd0698f62561 |

Head sha3:0cd15dfeb55d9b103ddb9955560c930b68040e1c9c54a8c48b2a5a9ae057d3f7. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.