A configuration baseline records the approved settings expected for a class of systems. It gives administrators and reviewers a reference point for detecting drift, evaluating changes, and rebuilding systems consistently.
Scope the baseline clearly
Identify the platform, version, role, environment, and assumptions the baseline covers. A workstation, public web server, database host, and network appliance have different purposes, so one configuration should not be presented as appropriate for every system.
Make important settings explicit
Capture settings that materially affect security and operations, including authentication, logging, network exposure, service configuration, update behavior, encryption options, and administrative access. Where a setting depends on business or regulatory context, document the decision rather than inventing a universal value.
Control changes and exceptions
Keep baselines versioned and connect material changes to review. When a system needs an exception, record the reason, owner, compensating measures where applicable, and a review or expiry point.
Check for drift
Compare deployed systems with the approved baseline at an interval appropriate to their importance and rate of change. NIST SP 800-53 Rev. 5 includes configuration-management controls covering baseline configuration and configuration settings.
Related knowledge
Continue with Cybersecurity Asset Ownership, Privileged Access Reviews, Service Account Security, and Security Alert Triage.
References
This is general cybersecurity guidance and does not determine legal, contractual, privacy, records-retention, or regulatory obligations.