The CDR finalizes the INIITIAL PRODUCT BASELINE and the SVR and/or PCA finalizes the PRODUCT BASELINE.

The question: "Is the CDR approved Technical Data Package part of the Customer Controlled Baseline?" may need clarification (In this case, is the customer the ACQ Program Office? - If so, then everything in the CDR (so long as the contract states such) should be included in the INITIAL product baseline - so if "anything changes" to include the TDP between the CDR and SVR/PCA, then yes, I believe that TDP needs to be updated prior to approval of the SVR/PCA since the CUSTOMER (in this case, the ACQ Program office) should be controlling the baseline.

We strongly recommend discussing this with Legal and Contracting if this involves a dispute here.

Here's some additional information:

The Initial product baseline is usually established and put under configuration control at each configuration item’s Critical Design Review (CDR), culminating in an initial system product baseline established at the system-level CDR. By DoD policy, the PM shall assume control over this initial product baseline after the system-level CDR and control all Class 1 changes.

Until completion of the System Verification Review (SVR) and/or FCA, Class 1 changes shall be those changes that affect the government performance specification. Following the SVR/FCA, the government will further define contractually what constitutes a Class 1 change. The system product baseline is finalized and validated at the Physical Configuration Audit (PCA)