What is a security baseline and how is it used to assess risk?

• A. A security baseline is a minimum secure configuration standard used to compare actual configurations against the baseline and identify deviations.
• B. A security baseline is a list of known vulnerabilities.
• C. A security baseline is a schedule for patch deployment.
• D. A security baseline is a data retention policy.

Answer: (A)

A security baseline sets the minimum secure configuration that systems should have. It serves as a reference point to compare actual configurations against, so any deviations can be found. Those deviations indicate weaknesses that could be exploited, which is how risk is assessed: you identify gaps, evaluate their potential impact and likelihood, and prioritize fixes. Baselines help maintain a consistent security posture across many hosts, streamline audits, and enable automated checks with configuration management and scanning tools. The baseline isn't a vulnerability list, nor a patch schedule, nor a data retention policy—it's about how you configure and harden systems. For example, a baseline might require only necessary services running and a defined password policy; if a system has extra services or weak password settings, that increases risk relative to the baseline and points to remediation.