Baseline Selection is the choice of the minimum security controls or configuration set that will apply to a system or environment. A poor baseline can leave gaps that attackers exploit, while an overly strict one can disrupt operations. Defenders should choose baselines according to risk, data sensitivity and system function.
What baseline selection means in practice
Baseline selection is the point where a security programme turns principles into a default control set. It defines the minimum level of hardening, logging, access control, and system configuration that should apply before any environment-specific tailoring begins.
Done well, a baseline gives teams a repeatable starting point for secure builds and reduces argument over what “secure enough” means. Done poorly, it creates blind spots, inconsistent builds, or controls so strict that teams bypass them in practice.
How baselines are chosen and tailored
A useful baseline is not one-size-fits-all. It should reflect the system’s function, the data it stores or processes, the operating environment, and the organisation’s tolerance for operational friction. Low-risk internal systems may justify a lighter baseline than systems that handle regulated data, internet exposure, or privileged administration.
Selection is usually paired with tailoring, because the same control set rarely fits every workload. A baseline can be strengthened through overlays, compensating controls, or inherited platform controls, but those adjustments should be deliberate and documented rather than improvised after deployment.
Why baseline quality matters for security and operations
The baseline is often the first place where security debt accumulates. If the initial control set is too weak, attackers can exploit missing logging, open management interfaces, weak authentication, or permissive defaults. If it is too rigid, teams may disable controls, delay patching, or create exceptions that are harder to govern than the original configuration.
That trade-off is why baseline selection is closely tied to architecture and deployment discipline. CIS Benchmarks are a common reference for hardened configuration baseline across operating systems, databases, cloud services and network devices. For control catalogues and tailoring practices, NIST SP 800-53 Guide is a practical reference point for baselines, overlays and control selection.
Baseline selection in governance and assurance
Baseline selection is not only a technical hardening exercise, it is also a governance decision. The chosen baseline becomes the reference point for build standards, audit expectations, exception handling, and control inheritance across similar systems.
Because of that, organisations usually need a clear rule for who can approve deviations, when overlays are allowed, and how baseline drift is detected over time. In mature programmes, the baseline is treated as a living standard that is reviewed when the threat landscape, regulatory expectations, or system role changes.
Risk and Threat Considerations
An under-scoped baseline can leave predictable openings, while an over-scoped baseline can drive shadow exceptions and control bypass. The risk is not just misconfiguration, it is systematic exposure across every system built from the same weak default.
Failure mechanism: Attackers benefit when baseline controls omit essential hardening, monitoring, or access restrictions, because the same weakness can be repeated across many hosts or services.
Impact: The result can be broader compromise, easier persistence, weaker detection, or operational instability if the baseline is so strict that teams start disabling it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Baseline selection is fundamentally about hardened default configuration. |
| Recommendation — Adopt secure configuration baselines and enforce them consistently across supported assets. | ||
| NIST SP 800-53 Rev 5 | CM-2 — Baseline Configuration | This control explicitly defines and manages configuration baselines. |
| CM-6 — Configuration Settings | Baseline selection depends on selecting and enforcing secure configuration settings. | |
| Recommendation — Define approved baselines, track changes, and control deviations through formal review. Set and validate secure configuration values for systems against the approved baseline. | ||
| ISO/IEC 27001:2022 | A.8.9 — Configuration management | Annex A requires managed configuration to keep system baselines controlled and repeatable. |
| Recommendation — Maintain approved configuration baselines and control deviations through change management. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Baseline selection should include protective controls appropriate to the data a system stores. |
| Recommendation — Choose baseline controls that protect sensitive data at rest on the system. | ||
Practitioner Guidance
Governance implication: Treat baseline selection as a formal design decision, not an afterthought. The baseline should be chosen from the system’s risk profile and then adjusted through controlled tailoring, not by ad hoc team preference.
What to watch for: Baseline quality usually shows up in exception volume, drift from approved configuration, and whether teams can deploy safely without bypassing security settings. A baseline that cannot be operated consistently is usually the wrong baseline.
Practitioner takeaway: The best baseline is the one that is secure enough to be worth enforcing and practical enough to be kept in place.
Related resources from NHI Mgmt Group
- Why does leaving Linux outside the passwordless baseline increase identity risk?
- Why does identity governance matter so much in GRC platform selection?
- What do security teams get wrong about authentication platform selection?
- When should organisations expand beyond the baseline controls in NIST 800-53?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org