====== Compliance Baseline ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

A Compliance Baseline is a [[dido:99_annexes:annex-b-terms-and-definitions:b:baseline|Baseline]] that identifies the approved compliance criteria, benchmarks, profiles, controls, assessment settings, remediation expectations, and evidence requirements applicable to a defined system, artifact, environment, or process.

The Compliance Baseline establishes the controlled reference against which compliance findings and evidence are assessed.

A Compliance Baseline may identify a benchmark version, a selected profile, a control set, tailoring decisions, exceptions, a remediation policy, an assessment method, an evidence format, and an applicable operating context.

Within Crucible, a Compliance Baseline may apply to an image build, infrastructure deployment, [[dido:99_annexes:annex-b-terms-and-definitions:s:software_factory|Software Factory]], or other controlled environment.

===== Definition =====

//[[dido:99_annexes:annex-b-terms-and-definitions:b:baseline|baseline]] that identifies the approved compliance criteria, benchmarks, profiles, controls, assessment settings, remediation expectations, and evidence requirements applicable to a defined entity//

===== Source =====

Generalized from compliance management, security engineering, control assessment, risk management, and configuration-management usage and specialized for the Crucible architecture and operational model.

===== Note =====

A Compliance Baseline differs from a [[dido:99_annexes:annex-b-terms-and-definitions:c:compliance_posture|Compliance Posture]]. The Compliance Baseline identifies the approved controlled configuration of compliance criteria and settings. The Compliance Posture describes the compliance condition or expectations applicable to an entity.

Changing a benchmark version, a selected profile, a tailoring decision, an exception, or a remediation policy may require a new Compliance Baseline.

===== Example =====

A Compliance Baseline identifies a specific DISA [[dido:99_annexes:annex-b-terms-and-definitions:s:stig]] benchmark release, the selected operating-system profile, enabled remediation, approved tailoring decisions, required scan stages, and the evidence artifacts produced from the assessment.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>