Security Baselines Control Control Name/Requirement Number Low High Baseline Configuration Reviews and Updates Security Configuration Checklist Refer to CITR-017: Program for control details. Baseline configuration documentation must be reviewed and updated: CM-2.1 X X At least annually; When required due to a significant system change; and As an integral part of information system component installations and updates. Retention of Previous Configurations The DOC requires OUs to retain at minimum one CM-2.3 X X previous version of the system configuration to support rollback. Configure Systems, Components, or Devices for High-Risk Areas CM-2.4 X X Safeguarding Information While on Refer to CITR-20: Foreign Travel for control details. Security Impact Analysis Security Impact Analysis CM-4 X X X Risk Management Framework Refer to CITR-019: (RMF) for control details. Separate Test Environments CM-4.1 X Risk Management Framework to CITR-019: (RMF) for control details. Configuration Settings Configuration Settings CM-6 X X X Security Configuration Checklist Refer to CITR-017: Program for control details. Least Functionality Periodic Review CM-7.1 X X Risk Management Framework Refer to CITR-019: (RMF) for control details. Prevent Program Execution CM-7.2 X X The list of prohibited and/or restricted functions, ports, protocols, and/or services, shall be included in the SSP. Information System Component Inventory CM-8 X X X Information System Component Inventory
Control Number Control Name/Requirement Security Baselines Low High Baseline Configuration CM-2.1 Reviews and Updates Refer to CITR-017: Security Configuration Checklist Program for control details. Baseline configuration documentation must be reviewed and updated: At least annually; When required due to a significant system change; and As an integral part of information system component installations and updates. X X CM-2.3 Retention of Previous Configurations The DOC requires OUs to retain at minimum one previous version of the system configuration to support rollback. X X CM-2.4 Configure Systems, Components, or Devices for High-Risk Areas Refer to CITR-20: Safeguarding Information While on Foreign Travel for control details. X X Security Impact Analysis CM-4 Security Impact Analysis Refer to CITR-019: Risk Management Framework (RMF) for control details. X X X CM-4.1 Separate Test Environments to CITR-019: Risk Management Framework (RMF) for control details. X Configuration Settings CM-6 Configuration Settings Refer to CITR-017: Security Configuration Checklist Program for control details. X X X Least Functionality CM-7.1 Periodic Review Refer to CITR-019: Risk Management Framework (RMF) for control details. X X CM-7.2 Prevent Program Execution The list of prohibited and/or restricted functions, ports, protocols, and/or services, shall be included in the SSP. X X Information System Component Inventory CM-8 Information System Component Inventory X X X
2014-doc-itspp.docx