BASELINE DECISION RECORD

This is an editorial worksheet, not an official NIST or CMMC form, and it is not an assessment result.
Do not enter CUI, drawings, or sensitive contract details on this website.

1. System
   A plain, non-sensitive name (“engineering file server and computer-aided design workstations”)
   Your answer:

2. Role
   Our own nonfederal system / operated on behalf of an agency / not yet known; identify the basis for that answer
   Your answer:

3. Information
   CUI / FCI only / other / not yet known—and who confirmed it
   Your answer:

4. Governing clause
   Clause number and title; incorporated requirement, amendment or modification; applicable deviation; date read. Keep sensitive documents in your approved workspace.
   Your answer:

5. Standard and revision
   The edition required by the instrument and its incorporated authorities (for example, “NIST SP 800-171 Rev. 2”), or “not yet known”
   Your answer:

6. CMMC level and type
   As written in the contract (for example, “Level 2 (Self)”), “none required” if established, or “not yet known”
   Your answer:

7. If 800-53 applies
   Revision, baseline or selected controls, tailoring, required parameters, and agency contact; identify anything still unknown
   Your answer:

8. Cloud and service providers
   Relevant provider responsibilities and where each responsibility record is filed; for cloud offerings, the applicable FedRAMP Authorized status or equivalency evidence. Do not apply the cloud rule automatically to non-cloud providers.
   Your answer:

9. Existing evidence to evaluate
   Requirement ID; old control ID and edition; evidence owner and internal reference; same boundary and implementation? applicable assessment objectives covered? yes / no / unknown; remaining gap
   Your answer:

10. Open question
   What’s still unknown, who must answer, date asked
   Your answer:

11. Decision
   “The supported requirement for this system is…” or “Applicability unresolved pending #10.” An unresolved decision does not suspend existing safeguards or contract duties. This is not an assessment result.
   Your answer:

12. Review
   Owner, date checked, next review date; revisit when the governing requirement or system boundary changes
   Your answer: