Baseline Configuration | Reviews and Updates
Configuration Management Policy for 18F
The 18F PMO must review baseline configuration changes at a minimum on an annual basis and on an as needed basis as a result of any significant change that impacts risk to the system, security audits or industry guidance.
The 18F PMO reviews and updates the baseline configuration of the information system when required by the FedRAMP JAB board. Significant change may result from, but are not limited to, multiple required changes occurring simultaneously, changes that impact/modify security settings, and/or major component additions and/or upgrades. Such changes will go through the 18F CM Process, presented to the FedRAMP assigned ISSO and if applicable, be submitted to the JAB for review, vetting acceptability and to ensure ongoing acceptance of security control implementation(s).
18F reviews all baseline configurations when there is a significant change to the cloud.gov system architecture or when its components undergo installation or upgrades.