Establish what approved operation means
A configuration baseline describes the approved state of a system or component at a useful level of detail. It helps the organization identify drift and review changes deliberately. NIST SP 800-171 Revision 2 requirement 3.4.1 addresses baseline configurations and inventories, while 3.4.2 addresses security configuration settings. Begin with the systems in the assessment scope and identify the applicable operating systems, applications, cloud settings, and supporting documentation. A generic hardening guide can inform the baseline, but the team needs to determine which settings actually apply, how they are enforced, and where approved exceptions are recorded.
Create a change record people can use
Record the proposed change, business reason, affected assets, requester, reviewer, decision, planned implementation, and verification result. Include a way to link supporting evidence and the previous configuration when necessary. NIST requirement 3.4.3 addresses tracking, reviewing, approving or disapproving, and logging changes. A particular ticketing platform is not prescribed. Choose a record that your administrators can maintain during normal work and that preserves the decision history. Distinguish an approval to attempt a change from proof that it was successfully implemented, because those are different stages with different evidence.
Analyze security impact before implementation
Review how a proposed change could affect authentication, access, logging, data flows, provider duties, encryption, and the system boundary. Requirement 3.4.4 addresses security impact analysis before changes are implemented. An apparently small integration can introduce a new storage location or administrative identity. Ask whether the change alters information handling or creates a dependency outside the currently documented environment. Record the actual analysis at an appropriate level of detail rather than filling a checkbox with no reasoning. Include a rollback or recovery approach when the change could interrupt critical work or weaken an operating safeguard.
Restrict who can make changes
Requirement 3.4.5 addresses physical and logical access restrictions associated with system changes. Identify the roles authorized to alter settings, deploy software, or approve exceptions, and connect that authority with the technical access provided. If a managed provider performs the work, make the approval and notification duties explicit in the service records. Review emergency changes as a designed process with appropriate oversight and records. Calling a change urgent should not make its implementation invisible. Check that ordinary users cannot bypass the approved process by installing software or enabling services through an unmanaged route.
Verify the result and update connected records
After implementation, check that the intended configuration exists and that important protections still operate. Compare the result with the acceptance criteria and document unresolved issues. Update the inventory, diagram, SSP, and evidence references when the change affects them. A completed deployment task does not automatically mean documentation has caught up. CMMC Pulsar can be evaluated for connecting remediation work, control coverage, and supporting artifacts, while administrators verify the actual settings. Use configuration exports, demonstrations, or other appropriate evidence to show the result instead of treating a project status label as technical proof.
Keep maintenance proportionate and continuous
Use recurring checks and change triggers that fit the environment, its risk, and applicable requirements. Review unsupported software, unnecessary services, and user-installed applications under the relevant configuration management requirements, including 3.4.6 through 3.4.9. Avoid inventing a universal federal monthly change-board rule when the source does not prescribe one. The practical goal is a traceable chain from approved baseline to authorized change to validated operating state. That chain helps staff answer assessment questions and makes it easier to investigate a later discrepancy without reconstructing decisions from scattered messages and individual memory.