NIST 800-171 Controls · Configuration Management

CM.2.001 — Establish and Maintain Baseline Configurations

CMMC Level 2SPRS if unmet: -5CRITICAL priority~12h to implement

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

What CM.2.001 means in plain English

Write down—and keep current—a list of every computer, server, router, and piece of software in your shop. For each machine, document what operating system and version it runs, what software is installed, and how it is configured for security (e.g., firewall on, BitLocker enabled, specific Group Policy settings). This "baseline" is your reference point: if something changes unexpectedly, you can detect it. For an 8-person shop this might be a spreadsheet and a Word document. Think of it as the build sheet for your CNC machines, but for your IT.

The assessment question

“Is there a documented and maintained baseline configuration and hardware/software inventory for all systems that process, store, or transmit CUI, updated within the past 12 months?”

How to implement CM.2.001

Create a Hardware Inventory spreadsheet with columns: Device Name, Device Type, Make/Model, Serial Number, Operating System + Version, Location, Primary User, Date Added. List every computer, laptop, server, network device, and printer that touches your network.
Create a Software Inventory spreadsheet with columns: Software Name, Version, License Key/Type, Installed On (device name), Business Purpose, Vendor. Walk through each device with "Apps & Features" (Windows Settings) to populate this.
Document a Baseline Configuration document for each device type. For your standard Windows workstation this means: OS version + patch level, enabled Windows features, installed software list, Group Policy settings (password policy, screen lock, firewall), BitLocker status, and antivirus product and version.
Use the free Microsoft Security Compliance Toolkit (download from Microsoft) to generate and export a baseline Group Policy configuration. This creates an exportable, auditable record of your security settings.
Schedule a quarterly review to update the inventories when equipment is added or removed. Store all documents in your CMMC evidence folder under "CM — Baseline Configuration."

Evidence your assessor will ask for

Hardware inventory spreadsheet showing all devices with OS versions and serial numbers
Software inventory spreadsheet showing all installed applications across all systems
Baseline configuration document(s) showing security settings for each device type
Date stamp showing inventories were updated within the past 12 months
Group Policy or Microsoft Security Compliance Toolkit export of security baseline settings

Does AI prompt monitoring help with this control? Honestly, no.

CM.2.001 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Configuration Management controls

CM.2.002

Establish and Enforce Security Configuration Settings

CM.2.003

Track, Review, Approve, and Log Changes to Systems

CM.2.004

Analyze Security Impact of Changes Prior to Implementation

CM.2.005

Define and Enforce Access Restrictions for Configuration Changes

CM.2.006

Employ Principle of Least Functionality

CM.2.007

Restrict, Disable, or Prevent Use of Nonessential Programs

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment