What is one of the reasons a baseline might be changed?

A configuration baseline is a formally agreed-upon specification of a system that serves as the basis for all subsequent changes. Baselines are established to control and manage change. A baseline is changed only through formal change control procedures. When numerous change requests are submitted and approved, they often signify a major update, a new version, or a significant evolution of the system's functionality or security posture. This accumulation of approved changes necessitates the creation of a new, updated baseline to reflect the current, authorized state of the system. This process ensures that the system's configuration remains managed and documented.

B. To reduce redundancy is a goal that might lead to a change request, but it is not the direct procedural reason for changing the baseline itself.

C. A natural disaster is an event that causes a deviation from a baseline and may trigger recovery procedures, not a planned reason to formally change the baseline.

D. A power fluctuation is a temporary operational issue or an event causing a deviation, not a trigger for a formal, permanent change to the system's baseline configuration.

1. National Institute of Standards and Technology (NIST). (2011). Special Publication (SP) 800-128, Guide for Security-Focused Configuration Management of Information Systems. Section 2.3.2, Page 13. "Baselines are updated as a result of approved changes to the information system."

2. Joint Task Force Transformation Initiative. (2018). NIST Special Publication (SP) 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. Control CM-2, Baseline Configuration. The discussion notes that baselines are reviewed and updated "at a minimum, following the implementation of a significant change."