What is a security baseline, and how is it used in ongoing architecture assurance?

• A. A marketing template
• B. A random collection of guidelines
• C. A minimum set of controls configured to meet a standard; used as a reference for configuration, compliance, and difference analysis
• D. A project plan

Answer: (C)

A security baseline is a defined minimum secure configuration that a system must meet to align with a standard. It serves as a reference point for how systems should be configured, for proving compliance, and for performing drift or difference analysis between the intended secure state and what’s actually deployed.

In ongoing architecture assurance, baselines are established and maintained as the anchor for security governance. They’re used to configure new and existing systems consistently, to continuously monitor for deviations from the approved settings, and to guide remediation when configurations drift. Because the baseline captures the required controls in a repeatable form, it supports evidence collection for audits, helps assess the impact of proposed changes, and enables rapid detection of misconfigurations or noncompliance across the environment.

For example, a baseline might specify firewall rules, disabled unused services, patch levels, and password policies. If a server drifts from this baseline, it flags a security gap that needs to be addressed, while updates to the baseline reflect evolving standards or new threat intelligence.

This concept isn’t a marketing template, a random collection of guidelines, or a project plan; it’s the authoritative, minimal set of configurations used to measure, enforce, and assure the security posture of the architecture over time.