Configuration Management

The institution shall establish and maintain baseline configurations and inventories of institutional systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. The inventory shall contain information about all users and all accounts in systems and applications.

The institution shall establish and enforce security configuration settings for information technology products employed in institutional systems.