Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Security Standards and Baseline Requirements
From intent to specifics
A policy says “access must be strongly authenticated”. A standard says how: “MFA for all remote and privileged access; passwords at least 14 characters; lockout after 10 failed attempts”. Standards make policy specific, measurable and auditable. They’re mandatory and must support, not contradict, the policy above them.
| Area | Example requirement |
|---|---|
| Authentication | MFA for remote and privileged access |
| Encryption | AES-256 at rest; TLS 1.2 or higher in transit |
| Logging | Security events kept for 12 months and sent to the SIEM |
| Patching | Critical patches on internet-facing systems within 7 days |
| Secure development | Code review and static analysis before release |
Standards change more often than policies, as technology and threats evolve.
Security baselines
A security baseline is the minimum secure configuration for a type of system: an operating system, a database, a cloud service, a network device. Baselines:
- Start from a benchmark, such as the CIS Benchmarks, vendor security guides or NIST guidance.
- Are tailored to the organisation’s risk and systems.
- Are approved and versioned.
- Are built in, through golden images and infrastructure-as-code templates.
- Are monitored: automated scanning detects configuration drift.
Using baselines well
- A baseline is a minimum, not a target. High-risk systems may need more.
- Build it in so systems start compliant.
- Monitor for drift; without automation, drift goes unnoticed.
- Deviations need a change record or an approved exception.
Example. Cloud scanning shows 30% of new virtual machines deviate from the baseline, because teams build them by hand. Moving to approved infrastructure-as-code templates brings deviation below 2% and makes every exception visible.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Document that sets the minimum password length | A standard |
| Minimum secure configuration for a type of system | A security baseline |
| Good starting point for baselines | Recognised benchmarks such as the CIS Benchmarks |
| How to detect configuration drift | Automated compliance scanning against the baseline |
| A system can’t meet the baseline | An approved exception with compensating controls |
In short
- Standards make policies specific and measurable: password length, encryption algorithms, logging requirements.
- Standards are mandatory; they're approved by the security function or management under the authority of the policy.
- A security baseline is the minimum secure configuration for a type of system (OS, database, cloud service, network device).
- Baselines usually start from recognised benchmarks such as CIS Benchmarks, then are tailored to the organisation's risk.
- Systems are built from baselines (golden images, infrastructure as code) and monitored for configuration drift.
- Standards and baselines change more often than policies, as technology and threats evolve.
Exam traps
- Standards belong under policy; they must not contradict it.
- A baseline is a minimum, not a target; higher-risk systems may need more.
- Configuration drift goes unnoticed without automated monitoring.
- Deviations from a baseline need a change record or an approved exception.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Security baselines
1 / 8