CM-2 (2) CM-2 (2) High The organization conducting The system is not the inspection/assessment considered a HIGH obtains and examines level. Therefore, this documentation of the use of AP is not applicable. the identified automated mechanisms used to maintain readily available baseline configuration of the information system. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms. CM-2 (3) CM-2 (3) High The organization conducting Moderate the inspection/assessment obtains and examines the documentation of the previous version of the baseline configuration to determine if all IS components necessary for rollback are retained. DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 months. CM-2 (3) CM-2 (3) High The organization being Automatically Moderate inspected/assessed is compliant with this automatically compliant with CCI because they are this CCI because they are covered at the DoD covered at the DoD level. DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 months. CM-2 (6) CM-2 (6) blank blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines Therefore, this AP is development environment not applicable. baseline configuration documentation and ensures the organization is maintaining and managing a baseline configuration for the development environment separate from the operational baseline configuration. CM-2 (6) CM-2 (6) blank blank blank The organization conducting NIST has not the inspection/assessment allocated this AP. obtains and examines test Therefore, this AP is environment baseline not applicable. configuration documentation and ensures the organization is maintaining and managing a baseline configuration for the test environment separate
CM-2 (2) CM-2 (2) High The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms used to maintain readily available baseline configuration of the information system. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms. The system is not considered a HIGH level. Therefore, this AP is not applicable. CM-2 (3) CM-2 (3) High Moderate The organization conducting the inspection/assessment obtains and examines the documentation of the previous version of the baseline configuration to determine if all IS components necessary for rollback are retained. DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 months. CM-2 (3) CM-2 (3) High Moderate The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 months. Automatically compliant with this CCI because they are covered at the DoD CM-2 (6) CM-2 (6) blank blank blank The organization conducting the inspection/assessment obtains and examines development environment baseline configuration documentation and ensures the organization is maintaining and managing a baseline configuration for the development environment separate from the operational baseline configuration. NIST has not allocated this AP. Therefore, this AP is not applicable. CM-2 (6) CM-2 (6) blank blank blank The organization conducting the inspection/assessment obtains and examines test environment baseline configuration documentation and ensures the organization is maintaining and managing a baseline configuration for the test environment separate NIST has not allocated this AP. Therefore, this AP is not applicable.
RMF_Configuration-Management-Plan.docx