Skip to content

Configuration Baseline

What is Configuration Baseline?

A documented and agreed-upon specification of a system's configuration at a specific point in time, used as a reference for managing changes.

Governance

Each of these is named in at least one of the same controls as configuration baseline. The number is how many controls name both.

What the standards actually require on configuration baseline

Requirements naming configuration baseline across 6 standards, quoted from the control text.

Apply NATO-specific configuration baselines for NATO-Authorised Information and Communications Systems (ICS) per AC/322(SC/4) Cryptographic Policy + STANAG 4774 Confidentiality Metadata Binding.

NATO-NCIRC-6 · Vulnerability Management, Configuration Baselines, and Supply Chain Risk

Use Azure Policy and Defender for Cloud secure score to audit and enforce configuration baselines across subscriptions.

PV-2 · Audit and enforce secure configurations

Record a configuration baseline for every authorised change, so the approved state of each asset is known.

CCM-CCC-06 · Change Management Baseline

UR E27 requires equipment manufacturers to deliver hardened CBS with secure default configuration + secure communications. Hardening: minimum services + disabled debug + locked BIOS + secure boot + Trusted Platform Module (TPM) or equivalent root of trust + si...

IACS-UR-E27-Equipment-Hardening-SecureConfig-Communications · IACS UR E27 - Equipment Hardening + Secure Configuration + Secure Communications + Cryptography
BSIMM1 control

Software Environment. Cloud security controls are implemented so cloud-hosted applications inherit a secure configuration baseline.

SE1.3 · Implement cloud security controls
C2M21 control

ASSET domain. Establish and maintain configuration baselines for assets and manage changes to assets through a defined change-management process.

ASSET-2 · Manage Asset Configuration and Changes

Questions people ask about configuration baseline

What is Configuration Baseline?
A documented and agreed-upon specification of a system's configuration at a specific point in time, used as a reference for managing changes.
Why is Configuration Baseline important for compliance?
Configuration Baseline is a key concept in Governance. Understanding configuration baseline helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Configuration Baseline?
Configuration Baseline appears in the requirement text of NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC), Azure Security Benchmark, Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems, BSIMM. Across these standards we have identified 11 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Configuration Baseline?
Explore our compliance framework pages to see how configuration baseline applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Configuration Baseline applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Written and maintained by Gerard Blokdyk, The Art of Service.