CM - Configuration Management (Level 2)

Level 2 Configuration Management requires organizations to establish documented policies and procedures for managing hardware, software, and firmware configurations, ensuring that any changes are tracked, approved, and implemented consistently. The focus is on maintaining baseline configurations, protecting against unauthorized modifications, and verifying that configurations support required security controls.