Valontir

NIST 800-171 · Configuration Management

Requirement 3.4.1

SPRS weight
SPRS weight: 5
POA&M eligibility
Not POA&M-eligible
Assessment objectives
6 assessment objectives

Official requirement text

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

Assessment objectives

Assessors don’t evaluate the requirement as one sentence; they walk these objectives one by one. Each must be met for the requirement to score.

  1. 3.4.1[a]a baseline configuration is established.
  2. 3.4.1[b]the baseline configuration includes hardware, software, firmware, and documentation.
  3. 3.4.1[c]the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle.
  4. 3.4.1[d]a system inventory is established.
  5. 3.4.1[e]the system inventory includes hardware, software, firmware, and documentation.
  6. 3.4.1[f]the inventory is maintained (reviewed and updated) throughout the system development life cycle.

Inside Valontir, this requirement carries a full plain-English guide: what it asks in normal words, what good looks like in a small shop, the evidence an assessor accepts, the common gaps that cost points, and a plain reading of every assessment objective shown above. See it in a demo.