What Is Security Baseline?

A security baseline is the defined minimum configuration a system must meet — which settings, which services disabled, which controls enabled. It is the standard that configuration management measures against.

Its practical value is that it converts security from a matter of individual judgement at build time into a specification that can be applied, verified and argued about once rather than repeatedly.

Start from published benchmarks

Independent benchmark documents exist for common operating systems, databases, browsers and cloud platforms, and vendors publish their own hardening guidance. Writing a baseline from first principles duplicates work that has already been done thoroughly.

They are a starting point rather than a policy. Published benchmarks are deliberately strict and include settings that will break things in particular environments, which is why they need adaptation rather than direct adoption.

Adaptation, and documenting what you dropped

Every deviation from a benchmark should be recorded with its reason. Without that record, the baseline becomes a document nobody can distinguish from a wish list, and the next person cannot tell a deliberate exclusion from an oversight.

It also makes audit straightforward: a baseline plus a documented and approved deviation list is a defensible position, where silent divergence from a published benchmark is not.

Applying it at build time

Baselines applied during provisioning — through images, templates or configuration code — cost nothing per system. Baselines applied to systems already in production require testing, change control and negotiation with owners.

That difference is large enough to shape the strategy: get new systems compliant automatically and address the existing estate as a separate, slower programme.

Different baselines for different roles

A workstation, a domain controller, an internet-facing web server and a database host have different requirements. One universal baseline is either too strict for some systems or too weak for others.

A small number of role-based baselines is manageable. A large number becomes unmaintainable, and the useful discipline is to keep a common core with role-specific additions rather than separate documents.

Keeping them current

Baselines age. New operating system versions introduce settings the document does not mention, benchmark guidance is revised, and a baseline written three versions ago silently stops covering much of the attack surface.

Annual review against the current benchmark is a reasonable minimum, with an out-of-cycle review whenever a major platform version is adopted.

In cloud, express the baseline as enforcement

Cloud platforms allow configuration standards to be enforced rather than merely checked — policies that refuse to create a storage resource without encryption, or that prevent a network rule opening administrative ports to the internet.

That converts the baseline from a document measured after the fact into a guardrail that makes the non-compliant state impossible. It is more work to set up and it removes the drift problem for everything it covers, which is a better place to spend effort than on detecting the same deviation repeatedly.

Where to start

Take one system type, adopt the published benchmark, record the settings you cannot apply and why, and check your existing estate against the result. The gap is the work.

See secure configuration baselines. GuardsArm runs security program reviews.