3.4 Configuration Management: the NIST SP 800-171 requirements

Stand up a hardware and software inventory (an RMM tool, Intune, or PDQ can auto-populate it) and document baseline configurations for each system type: OS version, required agents, key security settings. Capture golden images or configuration profiles so rebuilds match the baseline. Keep the inventory current through automated discovery rather than spreadsheets. Evidence: the inventory export, baseline documents per system type, and the imaging/profile artifacts.

Adopt a recognized hardening benchmark (CIS Benchmarks or DISA STIGs) and apply it via GPO, Intune security baselines, or configuration scripts, documenting any deviations with justification. Start with Windows endpoints and domain controllers, then firewalls and servers. Run a CIS-CAT or similar scan to measure conformance. Evidence: the applied baseline policies, deviation register, and scan results.

Implement lightweight change control: changes to servers, network gear, and security settings get a ticket describing the change, an approval by someone other than the implementer, and a record of the result. A shared ticketing tool or even a structured change log works at small scale: the key is that undocumented changes stop. Evidence: the change procedure and a sample of completed change tickets with approvals.

Add a required "security impact" field to your change process where the requester answers whether the change affects CUI protection, opens ports, alters access, or touches security tooling, with the approver reviewing that analysis before sign-off. This costs nothing beyond a template update. Evidence: the change template showing the impact analysis section and completed examples.

Restrict who can push changes: lock server room and network closet access physically, limit GPO/Intune/firewall admin roles to named change-authorized personnel, and remove developer or vendor write access to production. Document these restrictions in your change policy. Evidence: admin role membership exports, physical access lists, and the documented restrictions.

Strip systems down to what the mission needs: uninstall unused software, disable unneeded services and features (SMBv1, legacy protocols, sample applications), and use your hardening baseline as the enforcement mechanism. Reviewing one server and one workstation image for unnecessary services is a productive first afternoon. Evidence: baseline documentation of permitted services and scan output showing nonessential services disabled.

Run an internal port/service scan (Nmap or your vulnerability scanner) to find open ports and running services, then disable or firewall everything without a documented business need: keep a permitted ports/protocols/services list as the reference. Host firewalls (Windows Defender Firewall via GPO) enforce this at the endpoint. Evidence: the permitted list, scan results before/after cleanup, and firewall policy exports.

Deploy application control: Windows Defender Application Control or AppLocker in enforcement (or start in audit mode and tighten), or at minimum an EDR-based blocklist of known-unwanted software. Allowlisting by publisher/path is achievable for small fleets with standardized software. Document the policy choice (deny-by-exception or permit-by-exception) and who approves additions. Evidence: the AppLocker/WDAC policy export, approval records, and blocked-execution log samples.

Remove local admin rights so users cannot install software, and provide a request path (ticket plus approval) for legitimate needs: pair this with an approved software catalog or a self-service portal in your RMM/Intune. Run periodic software inventory reports to catch unauthorized installs. Evidence: the software request procedure, local admin removal policy, and inventory reports showing detection of unapproved software.