Control Baseline
What is Control Baseline?
The minimum set of security controls selected for a system based on its risk level and applicable regulatory requirements.
Frameworks that govern control baseline
What the standards actually require on control baseline
Requirements naming control baseline across 6 standards, quoted from the control text.
Baseline control principles for access control (required of every AI (minimum for a low inherent risk)). Identification and authentication govern access to systems, applications and hardware;
hkma-cyber-resilience-assessment-framework-c-raf::3.1.B · 3.1 Access control: baseline level →Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions
PL-11 · Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions →Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions
PL-11 · Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions →Execute the Categorize step per NIST SP 800-37 Rev 2 Chapter 3 Step 2. Categorise the information processed, stored, and transmitted by the system and the system itself per the impact levels in FIPS 199 (Low, Moderate, High) for confidentiality + integrity + a...
NISTSP37-2 · RMF Categorize Step: Information and System Categorisation →The organisation tailors the selected control baseline by applying specified tailoring actions. No enhancements.
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-11 · PL-11 Baseline tailoring →Section 9.3 of IRS Publication 1075 establishes the technical and procedural security controls + by inheritance from NIST SP 800-53 Rev 5 Security and Privacy Controls for Information Systems and Organizations.
IRSPub1075-Section93-NIST800-53-Inheritance-IRSModerate-Plus-Baseline-FIPS199-HIGH-Confidentiality · IRS Publication 1075 Section 9.3 + NIST SP 800-53 Rev 5 Inheritance + IRS Moderate-Plus Baseline (Not Just Moderate, Less Than High) + FIPS 199 Confidentiality HIGH for FTI + 18 Control Families + 200+ Controls →Questions people ask about control baseline
What is Control Baseline?
Why is Control Baseline important for compliance?
Which compliance frameworks address Control Baseline?
Where can I learn more about Control Baseline?
See how Control Baseline applies across compliance frameworks
Our platform maps 1,049 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.