Compliance Baseline

Go up to Terms and Definitions

Discussion

A Compliance Baseline is a Baseline that identifies the approved compliance criteria, benchmarks, profiles, controls, assessment settings, remediation expectations, and evidence requirements applicable to a defined system, artifact, environment, or process.

The Compliance Baseline establishes the controlled reference against which compliance findings and evidence are assessed.

A Compliance Baseline may identify a benchmark version, a selected profile, a control set, tailoring decisions, exceptions, a remediation policy, an assessment method, an evidence format, and an applicable operating context.

Within Crucible, a Compliance Baseline may apply to an image build, infrastructure deployment, Software Factory, or other controlled environment.

Definition

baseline that identifies the approved compliance criteria, benchmarks, profiles, controls, assessment settings, remediation expectations, and evidence requirements applicable to a defined entity

Source

Generalized from compliance management, security engineering, control assessment, risk management, and configuration-management usage and specialized for the Crucible architecture and operational model.

Note

A Compliance Baseline differs from a Compliance Posture. The Compliance Baseline identifies the approved controlled configuration of compliance criteria and settings. The Compliance Posture describes the compliance condition or expectations applicable to an entity.

Changing a benchmark version, a selected profile, a tailoring decision, an exception, or a remediation policy may require a new Compliance Baseline.

Example

A Compliance Baseline identifies a specific DISA Security Technical Implementation Guide (STIG) benchmark release, the selected operating-system profile, enabled remediation, approved tailoring decisions, required scan stages, and the evidence artifacts produced from the assessment.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.