What Is a Security Baseline?
A security baseline is a documented minimum set of controls and configuration settings that a system must meet to be considered acceptably secure. Instead of hardening each machine by intuition, you define a known-good standard once and apply it everywhere — so every system starts from the same secure floor, and drift away from it becomes visible and fixable.
Why do baselines beat ad-hoc hardening?#
Because consistency is itself a security property. Without a baseline, every system reflects whoever built it and whenever they built it — a patchwork nobody can reason about. A baseline gives you:
- Repeatability — every new system is secured the same way, automatically.
- Measurability — you can scan for drift from the standard.
- Accountability — “secure” becomes a defined, checkable state, not an opinion.
This is fail-safe defaults at the fleet level: secure is the starting configuration, not something added later if there is time.
Where do baselines come from?#
You rarely write one from scratch. Established sources give ready-made, expert-reviewed baselines:
| Source | Covers |
|---|---|
| CIS Benchmarks | OSes, cloud, containers, apps |
| DISA STIGs | Government/defense systems |
| Vendor hardening guides | Specific products |
| Your own policy | Organization-specific additions |
Baselines are the practical face of hardening. See CIS Benchmarks in depth and the Defense & Hardening hub; more at the Security Fundamentals hub.
Frequently asked questions#
What is a security baseline?
A security baseline is a documented, agreed set of minimum security settings and controls that every system of a given type must meet — a known-good configuration. It replaces ad-hoc, inconsistent hardening with a repeatable standard, so every server, laptop, or cloud resource starts from the same secure floor.
What are CIS Benchmarks?
CIS Benchmarks are freely available, consensus-developed configuration baselines for operating systems, cloud platforms, and applications. They give specific, prioritized settings to harden a system, and are widely used as ready-made baselines rather than writing hardening standards from scratch.