CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

3.4.1Know what you have and how it is set up in Rev. 3

Reworded: 03.04.01 Baseline Configuration. Gains organization-defined parameters.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

Side by side

Rev. 2 · in force 3.4.1 System Baselining

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

Assessment objectives · 800-171A

  1. [a] a baseline configuration is established
  2. [b] the baseline configuration includes hardware, software, firmware, and documentation
  3. [c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle
  4. [d] a system inventory is established
  5. [e] the system inventory includes hardware, software, firmware, and documentation
  6. [f] the inventory is maintained (reviewed and updated) throughout the system development life cycle

Rev. 3 · not adopted 03.04.01 Baseline Configuration

a. Develop and maintain under configuration control, a current baseline configuration of the system.

b. Review and update the baseline configuration of the system [Assignment: organization-defined frequency] and when system components are installed or modified.

Determination statements · 800-171A Rev. 3

  1. 03.04.01.a[01] a current baseline configuration of the system is developed.
  2. 03.04.01.a[02] a current baseline configuration of the system is maintained under configuration control.
  3. 03.04.01.b[01] the baseline configuration of the system is reviewed <A.03.04.01.ODP[01]: frequency>.
  4. 03.04.01.b[02] the baseline configuration of the system is updated <A.03.04.01.ODP[01]: frequency>.
  5. 03.04.01.b[03] the baseline configuration of the system is reviewed when system components are installed or modified.
  6. 03.04.01.b[04] the baseline configuration of the system is updated when system components are installed or modified.

Organization-defined parameters

  • A.03.04.01.ODP[01] the frequency of baseline configuration review and update is defined.

Draws on Rev. 2 3.4.1.

Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.

Word by word

The Rev. 2 requirement compared with its Rev. 3 successor. A mechanical comparison of the two verbatim texts, not an interpretation.

removed in Rev. 3 added in Rev. 3

Rev. 2 3.4.1 → Rev. 3 03.04.01 Baseline Configuration

Establish Develop and maintain under configuration control, a current baseline configurations and inventories configuration of organizational systems (including hardware, software, firmware, the system. Review and documentation) throughout update the respective baseline configuration of the system development life cycles. [Assignment: organization-defined frequency] and when system components are installed or modified.

7 words kept, 16 removed, 26 added. Rev. 3 statement labels omitted for the comparison.

What NIST says changed

  • New security requirement title
  • Aligned with SP 800-53, Rev 5 to provide more comprehensive detail on and foundational tasks for implementing a baseline configuration
  • Added new ODP: frequency to review and update baseline configuration

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “Minor change”. At adoption, Bedrock files this under “Review”.

NIST's Rev. 3 discussion for 03.04.01

Baseline configurations for the system and system components include aspects of connectivity, operation, and communications. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for the system or configuration items within the system. Baseline configurations serve as a basis for future builds, releases, or changes to the system and include information about system components, operational procedures, network topology, and the placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as the system changes over time. Baseline configurations of the system reflect the current enterprise architecture.

What this means for you now

Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.4.1 as written in Rev. 2, and if you already choose a value for the parameters above in practice, write it down where your system security plan can find it.

Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.

Back to the Rev. 2 vs Rev. 3 overview

Where this page's facts come from
Rev. 2 text and objectives
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Mapping and change class
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Rev. 3 03.04.01
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]