Quick Answer: A system baseline configuration is a documented “known good state” for every device and system in your organization. For CMMC Level 2 compliance, it’s a foundational requirement under control CM.L2-3.4.1 that covers hardware, software, firmware, cloud environments, and must be actively maintained throughout the entire system lifecycle.
If you don’t have a master blueprint for your network, how do you know when something has changed or gone wrong? That’s the core question behind one of the most important controls in CMMC Level 2 compliance: CM.L2-3.4.1, the system baseline configuration requirement.
The name sounds technical, but the concept is straightforward. A baseline is simply a documented record of exactly how your technology should look and function before it ever touches your network. Think of it like a floor plan for your house. If someone moves a wall, you’d know immediately because you have the original blueprint to compare against. Your IT environment works the same way.
What Does a System Baseline Configuration Actually Cover?
Most people picture physical devices when they hear the word “baseline.” Laptops, firewalls, servers sitting in a closet. And yes, all of that counts. But a proper CMMC Level 2 baseline goes much further.
Your baseline must also include your cloud and external systems. If your business uses Microsoft 365, Azure, or AWS, those environments need their own documented standards just as much as the hardware on your desk does. That means defining:
- Which security groups are permitted
- Which third-party applications have access to your data
- Which geographic regions are allowed to connect to your tenant
The rule of thumb is simple: if a system touches your company’s information, it needs a baseline.
What Auditors Expect to See During a CMMC Level 2 Assessment
When an assessor shows up for your CMMC Level 2 audit, they aren’t going to take your word for it. You need paperwork. Specifically, you need to show two things:
- An established baseline configuration—a documented standard for how each system should be configured
- A system inventory—a thorough, up-to-date list of all hardware, software, and firmware across your network, along with technical documentation for each device
Both records need to be detailed and current. More importantly, you have to demonstrate that these documents are reviewed and updated throughout the entire system development lifecycle.
That means from the moment a new system is being planned or purchased, all the way through its retirement, you are actively maintaining those records. This ongoing maintenance is what separates a genuine security program from a one-time checkbox exercise—and auditors know the difference.
Why Keeping Detailed Records Sets Your Business Up for Success
Thorough documentation isn’t just about passing an audit. It’s what makes your entire CMMC Level 2 compliance program sustainable over time.
When records are incomplete or outdated, it creates gaps that are very hard to explain to an assessor. Worse, those same gaps are exactly where real threats go unnoticed. On the other hand, businesses that maintain accurate baselines and inventories consistently report that the audit process feels far less stressful.
A good habit is to treat your baseline documentation the same way you’d treat your business’s financial records. You wouldn’t let your books go unreviewed for a year. The same discipline applies here.
The Real Value of a Baseline Configuration: Stopping Configuration Drift
Here’s a problem that quietly affects almost every growing business: configuration drift. Over time, employees install different software, settings get adjusted for convenience, and what was once a consistent environment slowly becomes a collection of unique, unpredictable systems. Every device becomes its own snowflake.
This is a significant security risk. When every system looks different, spotting an unauthorized change becomes nearly impossible. A baseline configuration solves this by giving you a fixed point of comparison. When something changes, you catch it quickly, before it turns into a serious problem.
A well-maintained baseline moves your organization from guessing that a system is secure to knowing it is secure, because you can verify it against your documented standard. For businesses handling Controlled Unclassified Information (CUI), that level of certainty is exactly what CMMC Level 2 demands.
Where to Start if You Don’t Have Documentation Yet
Feeling overwhelmed? That’s normal! The good news is you don’t have to document everything at once. Start with your most critical environment, whether that’s your primary cloud tenant like Microsoft 365 or your standard employee workstations. Write down the essential software, security settings, and access requirements. Once you have that first blueprint complete, the rest of the process becomes much more manageable.
Good documentation really is the difference between a stressful audit and a successful one.
Ready to Get Audit-Ready for CMMC Level 2?
Building a compliant baseline configuration takes time, but it’s the most important work you can do to protect your network and qualify for Department of Defense contracts. If the technical side or the organizational effort feels like too much to tackle alone, HRCT is here to help.
Our team works with businesses of all sizes to build system baselines, document inventories, and prepare for CMMC Level 2 certification. Get in touch with HRCT today and take the first step toward audit-ready compliance!
Frequently Asked Questions
What is a system baseline configuration in CMMC?
A system baseline configuration is a documented record of the known good state for every device and system in your organization. It defines exactly how each system should be set up, including hardware, software, firmware, and cloud environments. CMMC Level 2 requires this under control CM.L2-3.4.1.
Does a CMMC Level 2 baseline need to include cloud systems like Microsoft 365 and Azure?
Yes. Any system that touches your company’s information, including cloud platforms like Microsoft 365, Azure, and AWS, must be included in your baseline configuration. You need to document security groups, permitted applications, and access settings for each environment.
What is configuration drift and why does it matter for CMMC Level 2?
Configuration drift happens when systems gradually change over time through software installs, settings adjustments, and user modifications. This creates inconsistency across your environment and makes it hard to detect unauthorized changes. A baseline configuration gives you a standard to compare against so you can identify and respond to changes quickly.
What documentation do CMMC Level 2 auditors look for during an assessment?
Auditors expect to see a current baseline configuration and a complete system inventory that includes all hardware, software, and firmware. They also need evidence that both documents are reviewed and updated throughout the full lifecycle of each system, not just created once and left unchanged.
How do I start building a baseline configuration if I have nothing documented today?
Start with your most critical system, such as your primary cloud tenant or standard workstations. Document the essential software, security requirements, and access standards for that environment first. Once the first baseline is complete, applying the same process to the rest of your systems becomes much more intuitive.