# NIST800 53 CM-2 — Baseline Configuration

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist80053_cm2_ad6d16c9e4-nist800-53-cm-2-baseline-configuration
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [Configuration Management](https://support.icompaas.com/support/solutions/folders/f_gen_62000112528_configurationmanagement)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 53 · Control CM-2 · Priority: high · Component: Configuration Management

### What this control covers

Develops, documents, and maintains a current baseline configuration under configuration control, updating it periodically or when components change. This control supports the Baseline Configuration System capability within the Configuration Management family.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### GCP

**Org Policy Service** for guardrails and **Config Validator** in CI to pre-check Terraform plans against policy as code (Rego).

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Baseline Configuration.

### Quick checklist

-   Security — Management / System
-   Configuration — Management / System
-   Network — Management / System
-   System — Management / System
-   Control — Management / System
-   Baseline — Management / System

### Related articles on this site

-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)](https://support.icompaas.com/support/solutions/articles/62000084031-ensure-a-log-metric-filter-and-alarm-exist-for-changes-to-network-access-control-lists-nacl-)
-   [2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected](https://support.icompaas.com/support/solutions/articles/62000219760-2-10-ensure-that-microsoft-cloud-app-security-mcas-integration-with-security-center-is-selected)
-   [Ensure Diagnostic Setting captures appropriate categories from the control/management plane](https://support.icompaas.com/support/solutions/articles/62000219824--ensure-diagnostic-setting-captures-appropriate-categories-from-the-control-management-plane)

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.