Configuration Baseline
What is Configuration Baseline?
A documented and agreed-upon specification of a system's configuration at a specific point in time, used as a reference for managing changes.
Terms that appear alongside configuration baseline
Each of these is named in at least one of the same controls as configuration baseline. The number is how many controls name both.
- baseline 10 shared controls
- secure configuration 4 shared controls
- hardening 3 shared controls
- audit 2 shared controls
- nist 2 shared controls
- policy 2 shared controls
- integrity 2 shared controls
- hardening guide 2 shared controls
Frameworks that govern configuration baseline
What the standards actually require on configuration baseline
Requirements naming configuration baseline across 6 standards, quoted from the control text.
Configuration baselines are established, at least in an ad hoc way, as point-in-time captures for managing the integrity of assets through their lifecycle.
australian-energy-sector-cyber-security-framework-aescsf::ASSET-3a · ASSET-3a: Configuration baselines established →A configuration baseline is the approved set of configuration information that defines the product or service; the baselines together with approved changes make up the current approved configuration.
iso-10007-2017::5.3.3 · Configuration baselines →Apply NATO-specific configuration baselines for NATO-Authorised Information and Communications Systems (ICS) per AC/322(SC/4) Cryptographic Policy + STANAG 4774 Confidentiality Metadata Binding.
NATO-NCIRC-6 · Vulnerability Management, Configuration Baselines, and Supply Chain Risk →GSA, through the FedRAMP Director and with NIST and CISA, develops FedRAMP policies and practices that incentivize or require cloud service providers in the FedRAMP Marketplace to produce baselines with specifications and recommendations for how agencies shoul...
us-executive-order-14144-strengthening-and-promoting-innovation-in-the-nations-cybersecurity::3(d) · Sec. 3(d) (now 3(b)) Provide agency configuration baselines for cloud services (FedRAMP) →Internal and external support services alike are defined and managed through formal agreements such as service level agreements that define the services, service levels and the responsibilities of the provider and the regulated company, with provider capabilit...
gamp-5-good-automated-manufacturing-practice::4.3.2 · 4.3.2 Operation: Service Management and Performance Monitoring →Use Azure Policy and Defender for Cloud secure score to audit and enforce configuration baselines across subscriptions.
PV-2 · Audit and enforce secure configurations →Questions people ask about configuration baseline
What is Configuration Baseline?
Why is Configuration Baseline important for compliance?
Which compliance frameworks address Configuration Baseline?
Where can I learn more about Configuration Baseline?
See how Configuration Baseline applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.