Configuration Management has the second-highest point density in the standard: nine requirements, 33 points, and six of them worth five points each. It is about knowing exactly what you have, defining how it should be configured, controlling changes, and running only what is needed.
Because so many of its requirements are worth five points, a weak configuration management program can cost more than the entire Access Control family's most commonly missed items combined.
What the Configuration Management family covers
Configuration Management contains 9 requirements, numbered 3.4.1 to 3.4.9 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix CM.L2, so 3.4.1 appears as CM.L2-3.4.1.
The family has three parts: inventory and baselines (3.4.1, 3.4.2), change control (3.4.3–3.4.5), and least functionality (3.4.6–3.4.9). The inventory created under 3.4.1 is also the foundation for scoping and for the asset categories documented in the SSP.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.4.1 | Establish and maintain baseline configurations and inventories of systems, including hardware, software, firmware and documentation | 5 | No |
| 3.4.2 | Establish and enforce security configuration settings | 5 | No |
| 3.4.3 | Track, review, approve or disapprove, and log changes to systems | 1 | Eligible |
| 3.4.4 | Analyze the security impact of changes prior to implementation | 1 | Eligible |
| 3.4.5 | Define, document, approve and enforce access restrictions associated with changes | 5 | No |
| 3.4.6 | Employ the principle of least functionality | 5 | No |
| 3.4.7 | Restrict, disable or prevent nonessential programs, functions, ports, protocols and services | 5 | No |
| 3.4.8 | Apply deny-by-exception (blacklisting) or permit-by-exception (whitelisting) to software | 5 | No |
| 3.4.9 | Control and monitor user-installed software | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 33 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.4.1, 3.4.2, 3.4.5, 3.4.6, 3.4.7 and 3.4.8. The remaining 3 are worth one point each.
At 3.67 points per requirement, CM is expensive to neglect. The five-point requirements include the application allowlisting or denylisting of 3.4.8, which organizations often postpone because it is operationally disruptive.
Where configuration management fails
3.4.1 is tenth on the DIBCAC list, and the reason is almost always the inventory. Hardware is usually listed; software and firmware often are not, and neither are cloud services or specialized assets. A baseline configuration that cannot say which software versions are approved cannot be enforced.
The other recurring gap is 3.4.8. Requirement text allows either deny-by-exception or permit-by-exception, but assessors expect a real mechanism — an application control policy or a managed denylist — not a statement that users are not administrators.
Implementation priorities for Configuration Management
Build the inventory first, using automated discovery so that software and firmware are captured as well as hardware, and assign every asset to a CMMC asset category. Apply a hardened baseline to each system class and record deviations. Then restrict nonessential services and ports and introduce application control, piloting permit-by-exception on a small group before rolling it out. Change control comes last because it depends on knowing what the baseline is.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.4.3, 3.4.4 and 3.4.9 eligible for deferral.
Only 3.4.3, 3.4.4 and 3.4.9 are deferrable. Change-control process improvements can sit on a POA&M briefly, but the inventory, baselines and least-functionality controls must be in place.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- An asset inventory covering hardware, software, firmware and cloud services, with owners and asset categories.
- Documented baseline configurations, such as hardened images or configuration benchmarks, and proof they are applied.
- Change tickets showing review, security impact analysis and approval.
- A list of disabled ports, protocols and services and the method that enforces it.
- Application control or denylist configuration and records of exceptions.
Frequently asked questions
Does 3.4.8 require full application whitelisting?
No. NIST SP 800-171 allows either deny-by-exception (blacklisting) or permit-by-exception (whitelisting). Permit-by-exception is stronger and increasingly expected.
Can we use CIS Benchmarks as our baseline?
Yes. Recognized benchmarks are a good basis for 3.4.2, adjusted and documented for your environment.
Does the inventory need to include SaaS applications?
If they store, process or transmit CUI, or provide security functions for systems that do, yes.
What is a security impact analysis under 3.4.4?
A short documented review, before a change is made, of how the change could affect security controls. A field on the change ticket with the reviewer's assessment is usually enough.