The baseline should cover which of the following?

A security baseline establishes a standard, minimum level of security configuration for a system or application. The primary goal of a baseline is to ensure consistency and enforce a foundational security posture across the enterprise. To be effective, this standard should be applied as broadly as possible, covering the maximum number of relevant systems. This approach simplifies management, auditing, and compliance by creating a uniform and predictable security environment. While baselines help with compliance and may include settings for alerting, their fundamental purpose is widespread, standardized application.

A. Data breach alerting and reporting is a specific security control that might be part of a baseline, but it does not define the baseline's overall scope.

B. A baseline is a tool to help achieve compliance, but it typically covers technical configurations and may not address all administrative or physical regulatory requirements.

D. Version control is a process for managing changes to the baseline itself, not a component of what the baseline covers on the target systems.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Rev. 5). Section 2.3.2, "Baselines," p. 18. "Organizations can implement baselines that are organization-wide, for specific communities of interest, or for specific information systems."

2. National Institute of Standards and Technology (NIST). (2018). Guide for Applying the Risk Management Framework to Federal Information Systems (NIST Special Publication 800-37, Rev. 2). Appendix F, "Security and Privacy Control Baselines," p. 133.