---
name: framework-financial-services-controls-cm-2
title: CM-2 - Baseline Configuration
description: Develop, document, and maintain under configuration control, a current baseline configuration of the system.
last-updated: 2026-08-26
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/framework-financial-services-controls?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# CM-2 - Baseline Configuration
{: #cm-2}

## Control requirements
{: #control-requirements}



### CM-2 (a)
{: #cm-2-a}


Develop, document, and maintain under configuration control, a current baseline configuration of the system.


### CM-2 (b)
{: #cm-2-b}


Review and update the baseline configuration of the system:
1. _[IBM Assignment: at least annually]_;
2. When required due to _[IBM Assignment: to include when directed by IBM and/or customer]_; and
3. When system components are installed or upgraded.






## Additional IBM Cloud for Financial Services specifications
{: #additional-ibm-cloud-for-financial-services-specifications}

Baseline configuration must include any APIs enabled in the production environment.

Container Security Requirements: 
• All images must be considered as untrusted unless the contrary is proven and must not be deployed.







## NIST supplemental guidance
{: #nist-supplemental-guidance}

Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.