A security baseline is the minimum set of controls a system has to meet before it is allowed into production. Think of it as the floor rather than the ceiling: it defines what secure enough to connect means for a particular organization or class of system, so nothing ships in a state weaker than the agreed standard.
Baselines are usually built from established sources such as CIS Benchmarks, NIST SP 800-53, or DISA STIGs, then tailored to the environment. A system that falls short gets remediated before deployment or is accepted as a documented exception with someone signing off on the residual risk. The part teams underestimate is maintenance. A baseline set once and never revisited drifts out of date as new threats and features appear, and configuration drift slowly pulls live systems away from the standard they were built to. Periodic audits are what keep a baseline honest.
Why does a security baseline matter for the CISSP exam?
Security baselines are core to Domain 3: Security Architecture and Engineering and to Security Assessment and Testing. Know how baselines are set, tailored, maintained, and verified through configuration audits. CIS publishes widely used baselines in its CIS Benchmarks.
Related terms: Configuration Management, Security Policy