public:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1public:99_annexes:annex-b-terms-and-definitions:c:compliance_baseline [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== Compliance Baseline ======
  
 +[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 +
 +===== Discussion =====
 +
 +A Compliance Baseline is a [[public:99_annexes:annex-b-terms-and-definitions:b:baseline|Baseline]] that identifies the approved compliance criteria, benchmarks, profiles, controls, assessment settings, remediation expectations, and evidence requirements applicable to a defined system, artifact, environment, or process.
 +
 +The Compliance Baseline establishes the controlled reference against which compliance findings and evidence are assessed.
 +
 +A Compliance Baseline may identify a benchmark version, a selected profile, a control set, tailoring decisions, exceptions, a remediation policy, an assessment method, an evidence format, and an applicable operating context.
 +
 +Within Crucible, a Compliance Baseline may apply to an image build, infrastructure deployment, [[public:99_annexes:annex-b-terms-and-definitions:s:software_factory|Software Factory]], or other controlled environment.
 +
 +===== Definition =====
 +
 +//[[public:99_annexes:annex-b-terms-and-definitions:b:baseline|baseline]] that identifies the approved compliance criteria, benchmarks, profiles, controls, assessment settings, remediation expectations, and evidence requirements applicable to a defined entity//
 +
 +===== Source =====
 +
 +Generalized from compliance management, security engineering, control assessment, risk management, and configuration-management usage and specialized for the Crucible architecture and operational model.
 +
 +===== Note =====
 +
 +A Compliance Baseline differs from a [[public:99_annexes:annex-b-terms-and-definitions:c:compliance_posture|Compliance Posture]]. The Compliance Baseline identifies the approved controlled configuration of compliance criteria and settings. The Compliance Posture describes the compliance condition or expectations applicable to an entity.
 +
 +Changing a benchmark version, a selected profile, a tailoring decision, an exception, or a remediation policy may require a new Compliance Baseline.
 +
 +===== Example =====
 +
 +A Compliance Baseline identifies a specific DISA [[public:99_annexes:annex-b-terms-and-definitions:s:stig]] benchmark release, the selected operating-system profile, enabled remediation, approved tailoring decisions, required scan stages, and the evidence artifacts produced from the assessment.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>