☐ Service Provider Hybrid (Corporate and System Specific)
CM-1 What is the solution and how is it implemented?
Part a
Part b
CM-2 Baseline Configuration (L) (M) (H)
The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.
CM-2
Control Summary Information
Responsible Role:
Implementation Status (check all that apply):
☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
Control Origination (check all that apply):
☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for Click here to enter text. ,
CM-2 What is the solution and how is it implemented?
CM-2 (1) Control Enhancement (H)
The organization reviews and updates the baseline configuration of the information system:
[FedRAMP Assignment: at least annually or when a significant change occurs];
When required due to [FedRAMP Assignment: to include when directed by the JAB]; and
As an integral part of information system component installations and upgrades.
CM-2 (1) (a) Additional FedRAMP Requirements and Guidance:
Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, Page F-7.
CM-2 (1)
Control Summary Information
Responsible Role:
Parameter CM-2(1)(a)::
Parameter CM-2(1)(b):
Implementation Status (check all that apply):
☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
Control Origination (check all that apply):
☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for Click here to enter text. ,
CM-2 (1) What is the solution and how is it implemented?
