What it means
Baselines turn general requirements into repeatable settings. They may specify authentication, logging, patch levels, network exposure, encryption, allowed software, and administrative controls for a standard build.
Why it matters
Without a baseline, teams cannot reliably distinguish an approved configuration from drift, error, or unauthorized change.
Practical focus
- Create separate baselines for materially different system types
- Automate measurement where practical
- Record approved exceptions with owners and expiration dates
- Update baselines when threats, platforms, or requirements change
Common mistakes
- Copying a benchmark without considering operational needs
- Failing to test changes before broad deployment
- Measuring compliance without correcting persistent drift
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: