In Episode 2 of my Configuration Management series, I break down NIST SP 800-53 CM-2: Baseline Configuration. I explain baseline configuration in plain terms: it’s your stable, approved reference point for what the system is supposed to look like—components, settings, and how it’s put together. And it matters because baselines are what you use to manage change, support configuration audits, and keep compliance, quality assurance, and risk management grounded in something real. I also walk through the CM-2 control requirements in Rev. 5: develop, document, and maintain the current baseline under configuration control, then review and update it on an organization-defined frequency, when certain circumstances require it (like major upgrades or moving repositories), and when components are installed or upgraded. I touch on the discussion points (connectivity, operational/communication aspects, topology, logical placement) and the enhancements—like automation support, retention of previous configurations for rollback, separating dev/test from operational baselines, and configuring for high-risk areas. Finally, I give you my assessment/testing approach: start with policy and procedures (CM-1), then the SSP implementation statements, then any configuration management plan, and the documented baseline settings. From there, I validate the baseline in the repo (GitHub/GitLab/Azure DevOps), do walkthroughs with admins/devs, review version history and approvals, and confirm production is actually running the documented version.