In NIST SP 800-53, what best describes a control baseline and its importance?

• A. It's a set of security controls chosen for an impact level; it provides a starting point for securing a system and ensures consistency
• B. A baseline is a fixed, unchangeable set of controls applied to all systems.
• C. A baseline is only about physical security controls.
• D. Baseline is a government standard required by law.

Answer: (A)

A control baseline in NIST SP 800-53 is a starting point: a predefined set of security controls chosen to match a system’s impact level (low, moderate, or high). This provides a consistent foundation for securing similar systems, making planning, implementation, and assessment repeatable across environments. The key idea is to start with controls that are appropriate to how severe a loss or breach would be, then tailor that baseline to the specific system’s needs. You can add or remove controls and apply compensating measures as needed to address particular risks, mission requirements, or operating contexts. Because of that tailoring, the baseline is not fixed or unchangeable. It covers a broad range of controls, not just physical security, reflecting the full scope of cybersecurity. While it guides federal compliance under frameworks like FISMA, it’s a framework rather than a blanket legal mandate.