What is the primary purpose of a security baseline in a Protection of Assets program?

• A. A minimum set of controls/configurations used to measure compliance and guide improvements.
• B. A full suite of all possible controls with no risk.
• C. A standard operating procedure for incident response only.
• D. A random collection of policies with no measurement.

Answer: (A)

A security baseline defines the minimum set of security controls and system configurations that assets should meet. It provides a common, approved reference point to assess current security, measure adherence, and identify gaps. By comparing actual configurations against the baseline, an organization can quantify compliance and prioritize improvements, ensuring a consistent security posture across the environment. It isn’t intended to be all possible controls, nor is it limited to incident response procedures or a random collection of policies without measurement. Instead, the baseline anchors ongoing hardening efforts, guiding configuration standards, patching, access control, logging, and other measures, and it evolves as threats and technologies change.