CM-2 · Configuration Management · NIST SP 800-53 Rev5
CM-2: Baseline configurations of the system are established and maintained
How NIST SP 800-53 Rev5 control CM-2 (Configuration Management) maps to FedRAMP 20x Key Security Indicators, and the evidence scm.cc collects for it.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
What CM-2 requires
Baseline configurations of the system are established and maintained.
Paraphrased from NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations (checked 2026-10-31). scm.cc does not reproduce the official control text; read the NIST catalog for the normative wording.
FedRAMP 20x KSIs that cover CM-2
These Key Security Indicators officially cite CM-2 as a related SP 800-53 control, so satisfying them is how a 20x package demonstrates this control.
KSI-CMT-RMV — Redeploying vs Modifying
Change Management · official related-control citation: cm-2
KSI-CNA-DFP — Defining Functionality and Privileges
Cloud Native Architecture · official related-control citation: cm-2
KSI-CNA-IBP — Implementing Best Practices
Cloud Native Architecture · official related-control citation: cm-2
KSI-IAM-ELP — Ensuring Least Privilege
Identity and Access Management · official related-control citation: cm-2.7
KSI-MLA-EVC — Evaluating Configurations
Monitoring, Logging, and Auditing · official related-control citation: cm-2
KSI-PIY-GIV — Generating Inventories
Policy and Inventory · official related-control citation: cm-2.2
KSI-RPL-ABO — Aligning Backups with Objectives
Recovery Planning · official related-control citation: cm-2.3
KSI-SVC-ACM — Automating Configuration Management
Service Configuration · official related-control citation: cm-2, cm-2.2, cm-2.3
KSI-SVC-VRI — Validating Resource Integrity
Service Configuration · official related-control citation: cm-2.2
Evidence scm.cc collects for CM-2
scm.cc tracks this as manual evidence you attach; it validates and replays exactly what you provide (no automated claim beyond that).
Related Configuration Management controls
- CM-6 — Mandatory secure configuration settings are established and enforced