Security Baseline
What is Security Baseline?
A set of minimum security standards and configurations that all systems within an organisation must meet. Security baselines provide a consistent foundation for security across the environment and are often based on CIS Benchmarks or vendor hardening guides.
Terms that appear alongside security baseline
Each of these is named in at least one of the same controls as security baseline. The number is how many controls name both.
- baseline 15 shared controls
- information security 10 shared controls
- encryption 9 shared controls
- access control 7 shared controls
- integrity 5 shared controls
- security testing 5 shared controls
- audit 4 shared controls
- cybersecurity 4 shared controls
Frameworks that govern security baseline
What the standards actually require on security baseline
Requirements naming security baseline across 6 standards, quoted from the control text.
Define and keep current the minimum security requirements each class of application must satisfy before it is built or released.
CCM-AIS-02 · Application Security Baseline Requirements →The organisation sets down and keeps up to date the baseline security requirements that applications must meet.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::AIS-02 · Application Security Baseline Requirements →The bank documents and applies baseline security configurations for all categories of devices and systems (endpoints, mobiles, operating systems, databases, applications, network and security devices) from conception to deployment, with periodic review.
rbi-cybersecurity-framework-for-banks::66 · Para 66: documented security baselines for all device categories through the lifecycle →ITU-T Recommendation X.805 (10/2003), whose full title is in the framework name, is a foundational network security architecture standard published in October 2003 by ITU-T, the standardization arm of the International Telecommunication Union for telecommunica...
X805-Scope-Architecture-3Layers-3Planes-8Dimensions-5Threats-72Cells-X.800-Series-Heritage · ITU-T X.805 Scope + Security Architecture Overview + 3 Security Layers x 3 Security Planes (9 Modules) x 8 Security Dimensions = 72 Security Perspectives + 5 Threat Categories + X.800-Series Heritage + End-to-End Network Communications →Per Iowa Code 715D.5-1 and Iowa Personal Information Security Breach Notification Law (Iowa Code 715C separate statute) controllers and processors must implement security + breach response + records discipline.
ICDPA-Security-ReasonablePractices-Breach-Notification-Iowa-Code-715C-Records-Encryption-Pseudonymisation · Iowa CDPA Security + Reasonable Practices + Iowa Personal Information Security Breach Notification Law (Iowa Code 715C) + Records + Encryption + Pseudonymisation →Apply D3FEND HARDEN tactic to make compromise more difficult prior to attack. D3-AH Application Hardening (D3-DCE Dead Code Elimination + D3-EAL Exception Handler Pointer Validation + D3-PSL Pointer Authentication + D3-SU Software Update + D3-DLIC Driver Load...
MITRE-D3FEND-Harden-Tactic-Application-Credential-Message-Platform-Hardening-MFA-Encryption-Secure-Boot · MITRE D3FEND Harden Tactic + Application + Credential + Message + Platform + MFA + Encryption + Secure Boot →Questions people ask about security baseline
What is Security Baseline?
Why is Security Baseline important for compliance?
Which compliance frameworks address Security Baseline?
Where can I learn more about Security Baseline?
See how Security Baseline applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.