Which of the following is critical for establishing an initial baseline for software components in the operation and maintenance of applications?

Application monitoring procedures focus on observing runtime performance and availability metrics, not on documenting or controlling the approved state of software components.

Configuration control procedures are specifically designed to establish and maintain a baseline - a documented, approved snapshot of software components, versions, and settings. This baseline serves as the reference point for all future change management, allowing teams to detect unauthorized modifications, assess the impact of changes, and maintain system integrity throughout the application lifecycle.

Security audit procedures are used to evaluate compliance with security policies and identify vulnerabilities, but they do not establish or maintain the initial configuration baseline of software components.

Software patching procedures address the process of applying updates to remediate vulnerabilities or bugs, which occurs after a baseline is already established, not as the mechanism for creating one.