Skip to content

Control Baseline

What is Control Baseline?

The minimum set of security controls selected for a system based on its risk level and applicable regulatory requirements.

Information Security

Frameworks that govern control baseline

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on control baseline

Requirements naming control baseline across 6 standards, quoted from the control text.

FedRAMP High1 control

Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions

PL-11 · Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions →
FedRAMP Moderate1 control

Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions

PL-11 · Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions →
NIST SP 800-53 Rev 5 LOW1 control

Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions

PL-11 · Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions →
NIST SP 800-53 Rev 5 MODERATE1 control

Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions

PL-11 · Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions →
NIST SP 800-53 Revision 5.1 HIGH1 control

Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions

PL-11 · Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions →
NIST SP 800-373 controls

Execute the Categorize step per NIST SP 800-37 Rev 2 Chapter 3 Step 2. Categorise the information processed, stored, and transmitted by the system and the system itself per the impact levels in FIPS 199 (Low, Moderate, High) for confidentiality + integrity + a...

NISTSP37-2 · RMF Categorize Step: Information and System Categorisation →

Questions people ask about control baseline

What is Control Baseline?
The minimum set of security controls selected for a system based on its risk level and applicable regulatory requirements.
Why is Control Baseline important for compliance?
Control Baseline is a key concept in Information Security. Understanding control baseline helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Control Baseline?
Control Baseline appears in the requirement text of FedRAMP High, FedRAMP Moderate, NIST SP 800-53 Rev 5 LOW, NIST SP 800-53 Rev 5 MODERATE, NIST SP 800-53 Revision 5.1 HIGH. Across these standards we have identified 8 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Control Baseline?
Explore our compliance framework pages to see how control baseline applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Control Baseline applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.