It is imperative to establish and maintain baseline configurations and inventories of all organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. 

This requirement establishes and maintains baseline configurations for systems and system components including for system communications and connectivity. Baseline configurations are documented, formally reviewed, and agreed-upon sets of specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, and changes to systems. Baseline configurations include information about system components (e.g., standard software packages installed on workstations, notebook computers, servers, network components, or mobile devices; current version numbers and update and patch information on operating systems and applications; and configuration settings and parameters), network topology, and the logical placement of those components within the system architecture. Baseline configurations of systems also reflect the current enterprise architecture. Maintaining effective baseline configurations requires creating new baselines as organizational systems change over time. Baseline configuration maintenance includes reviewing and updating the baseline configuration when changes are made based on security risks and deviations from the established baseline configuration. 

All baseline configurations of systems will be defined in this wiki in a section subject to review by suitable approvers. Each baseline configuration shall be set up for a quarterly review (as a Policy Review) to ensure the configuration meets the organization's security standards.