Nursing laptops built ad hoc
Each floor PC had different software and open RDP. CM-2 introduces a single clinical image with BitLocker, EDR, and USB control — redeployed across clinics.
Baseline Configuration
High Risk
Moderate
Medium Cost
CM-2 requires developing, documenting, and maintaining under configuration control a current baseline configuration of the information system. Baselines are the approved secure builds for workstations, servers, network gear, and cloud images that process or reach ePHI — so systems do not drift into insecure one-off setups.
Control Objective
Ensure every in-scope system type has a documented, controlled secure baseline that is maintained as the known-good starting point for builds and rebuilds.
Implementation Guidance
- Define baselines by platform: clinical workstation, EHR app server, domain controller, firewall, cloud VM image, and biomed jump hosts where applicable.
- Capture OS hardening, agent stack (EDR, MDM), disk encryption, firewall, approved software, and logging settings.
- Store baselines under change control with version IDs and owners.
- Rebuild from baseline images rather than cloning unknown machines.
- Review baselines at least annually and after major threat/OS changes.
- Include cloud landing-zone baselines (security groups, CIS benchmarks).
- Document deviations with compensating controls and expiry.
- Tie CM-2 to CM-6 (settings) and CM-8 (inventory of components using each baseline).
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Post-ransomware rebuild
Recovery uses golden images from CM-2 instead of restoring possibly tainted OS volumes, then overlays data from CP-9 backups.
Cloud EHR interface server sprawl
Dev spun unique VMs by hand. CM-2 requires a hardened AMI/image pipeline for any host that can see ePHI interface traffic.
Best Practices
- Versioned golden images with owners.
- Automated build pipelines where possible.
- Annual baseline review tied to threat changes.
- Document and time-box deviations.
- Separate clinical vs admin baselines.
- Test images before fleet rollout.
Common Gaps & Violations
- No written baseline — tribal knowledge only.
- Gold image never updated for years.
- Every server configured uniquely.
- Deviations without approval.
- Baseline ignores logging/EDR agents.
Required Documentation
- Baseline configuration standard per platform
- Image/version register
- Change records for baseline updates
- Deviation/exception log
- Build checklist evidence
How to Test & Validate
- Compare a production clinical PC to the documented baseline.
- Verify new builds use the current image version.
- Review last baseline update date.
- Sample exceptions for expiry.
- Confirm ransomware recovery references golden images.
Audit Considerations
Assessors sample devices for consistency with stated baselines. Drift and undocumented builds weaken HIPAA technical safeguard narratives.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(1) Risk Management — secure baselines reduce identified configuration risks.
- 164.312(a)(1) Access Control — hardened defaults support limited access.
- 164.312(b) Audit Controls — baselines should include required logging.
- 164.308(a)(5)(ii)(B) Protection from Malicious Software — agent and hardening settings belong in baselines.
Compliance Tips
- Put baseline version on the asset record in CM-8 inventory.
- Rebuild a sample device quarterly from baseline as a control test.
- Include printer and VPN appliance baselines — not only Windows PCs.
Frequently Asked Questions
Is a CIS benchmark automatically our CM-2 baseline?
It is a strong starting point. Tailor, document, and control the version you actually deploy.
How does CM-2 differ from CM-6?
CM-2 is the approved system baseline build; CM-6 is enforcing and monitoring the detailed configuration settings that implement it.
Do SaaS apps need CM-2?
Focus on components you configure (tenant security baselines, connectors, jump hosts). Document shared responsibility.
References & Resources
- NIST SP 800-53 Rev. 5 — CM-2
- CIS Benchmarks / NIST SP 800-70
- Related controls: CM-6, CM-8, CM-3, SI-2
Related Guidelines
Related controls that commonly accompany CM-2.
Need Help Implementing CM-2?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.