Baseline Controls Identification and Documentation: A Comprehensive Guide
1. Introduction: Why Baseline Controls Identification Matters
Baseline controls identification is a foundational activity in the governance, risk, and compliance (GRC) lifecycle. Without a clearly defined set of baseline controls, organizations cannot consistently protect their information systems, ensure regulatory compliance, or manage risk effectively. Baseline controls serve as the minimum mandatory security requirements that must be applied across systems of similar type, classification, or risk profile. They form the starting point from which organizations tailor, supplement, or enhance their security posture.
Understanding baseline controls identification is critical for exam success in certifications such as CGRC (Certified in Governance, Risk, and Compliance), CISSP, CISM, and related frameworks because it sits at the intersection of risk management, control selection, and compliance documentation.
2. What Are Baseline Controls?
Baseline controls are a predefined set of minimum security controls assigned to an information system based on its categorization level (e.g., low, moderate, or high impact). These baselines are typically derived from authoritative sources such as:
• NIST SP 800-53 – Security and Privacy Controls for Information Systems and Organizations
• NIST SP 800-53B – Control Baselines for Information Systems and Organizations
• FIPS 199 – Standards for Security Categorization of Federal Information and Information Systems
• FIPS 200 – Minimum Security Requirements for Federal Information and Information Systems
• CNSS Instruction 1253 – Security Categorization and Control Selection for National Security Systems
A baseline is not a one-size-fits-all solution. It is a starting point that must be tailored to the specific environment, mission requirements, threat landscape, and organizational risk tolerance.
3. The Baseline Controls Identification Process
The process of identifying baseline controls follows a structured approach that is well-documented in the NIST Risk Management Framework (RMF). Here is the step-by-step breakdown:
Step 1: System Categorization
Before baseline controls can be identified, the system must be categorized using FIPS 199 criteria. This involves evaluating the potential impact (low, moderate, or high) on three security objectives:
• Confidentiality – Preserving authorized restrictions on information access and disclosure
• Integrity – Guarding against improper information modification or destruction
• Availability – Ensuring timely and reliable access to information
The highest impact level among the three objectives determines the system's overall impact level (also called the high-water mark approach).
Step 2: Selecting the Initial Baseline
Based on the system categorization, the organization selects the corresponding control baseline from NIST SP 800-53B (or the applicable framework). For example:
• A low-impact system receives the low baseline set of controls
• A moderate-impact system receives the moderate baseline set of controls
• A high-impact system receives the high baseline set of controls
Each baseline includes controls from various control families (e.g., Access Control, Audit and Accountability, Configuration Management, Incident Response, etc.).
Step 3: Tailoring the Baseline
Tailoring is the process of modifying the initial baseline to align with the organization's specific needs. Tailoring activities include:
• Identifying and designating common controls – Controls that are provided by the organization at an enterprise or system level rather than being implemented individually by each system
• Applying scoping considerations – Removing controls that are not applicable (e.g., removing wireless controls if the system has no wireless capability)
• Selecting compensating controls – Substituting equivalent controls when the original baseline control cannot be implemented as prescribed
• Assigning organization-defined parameters – Filling in variable values within controls (e.g., specifying password length requirements or audit log retention periods)
• Supplementing the baseline – Adding controls beyond the baseline to address specific risks, threats, or regulatory requirements
Step 4: Documentation
All baseline control selections, tailoring decisions, and justifications must be thoroughly documented. Key documentation artifacts include:
• System Security Plan (SSP) – The primary document that describes all security controls selected for the system, how they are implemented, and who is responsible
• Security Control Traceability Matrix – Maps controls to requirements, risks, and implementation status
• Plan of Action and Milestones (POA&M) – Documents controls that are not yet fully implemented and the planned remediation timeline
• Risk Assessment Report – Provides the rationale for tailoring decisions and acceptance of residual risk
• Control Allocation Table – Distinguishes between system-specific, common, and hybrid controls
4. How Baseline Controls Identification Works in Practice
Consider a federal agency deploying a new financial management system. Here is how baseline controls identification would work:
1. Categorize the system: Financial data involves sensitive budget information. The agency determines the system has moderate confidentiality, moderate integrity, and low availability impact. Using the high-water mark, the system is categorized as moderate impact.
2. Select the moderate baseline: The agency references NIST SP 800-53B and selects all controls in the moderate baseline. This includes hundreds of controls across 20 control families.
3. Tailor the baseline:
- The system does not use mobile devices, so mobile device management controls are scoped out with documented justification
- The agency adds an additional encryption control beyond the baseline because of regulatory requirements from the Treasury Department
- Organization-defined parameters are set: for example, AC-7 defines unsuccessful login attempts as 3 before lockout, with a 30-minute lockout duration
- Several controls are designated as common controls inherited from the agency's enterprise infrastructure (e.g., physical security controls from the facility management office)
4. Document everything: All decisions, justifications, parameter values, and responsibilities are recorded in the SSP, and any gaps are tracked in the POA&M.
5. Key Concepts to Master for the Exam
• High-Water Mark: The overall system categorization is determined by the highest impact level among confidentiality, integrity, and availability
• Common Controls: Controls inherited from the organization's infrastructure, not implemented at the individual system level. Examples include physical access controls, enterprise firewalls, and organization-wide security awareness training
• Hybrid Controls: Controls that are partially common and partially system-specific
• System-Specific Controls: Controls implemented solely by and for a specific information system
• Compensating Controls: Alternative controls used when the prescribed baseline control is infeasible, provided they offer equivalent protection
• Scoping: The process of narrowing the applicability of controls based on the system's technology, architecture, and operational environment
• Overlays: Pre-defined sets of supplemental controls or modifications to baselines for specific communities of interest, technologies, or operational environments (e.g., classified systems overlay, cloud computing overlay)
• Minimum Assurance Requirements: FIPS 200 defines minimum security requirements across 17 security-related areas that must be met through appropriate control baselines
6. The Relationship Between Baseline Controls and the RMF
Baseline controls identification occurs primarily in RMF Step 2: Select Security Controls. However, it is informed by Step 1 (Categorize) and directly influences subsequent steps:
• Step 3 – Implement: The selected and tailored baseline controls are implemented
• Step 4 – Assess: Controls are assessed to determine if they are implemented correctly and operating effectively
• Step 5 – Authorize: The authorizing official reviews the security package (including baseline documentation) to make a risk-based authorization decision
• Step 6 – Monitor: Controls are continuously monitored, and changes to the baseline are managed through configuration management
7. Common Pitfalls and Misconceptions
• Misconception: Baselines are final and cannot be changed. Reality: Baselines are starting points that must be tailored.
• Misconception: All systems with the same categorization have identical controls. Reality: Tailoring ensures controls are appropriate for each system's unique environment.
• Misconception: Common controls eliminate the need for system-level documentation. Reality: Even inherited common controls must be documented in the SSP, including the responsible entity and inheritance relationship.
• Misconception: Compensating controls are inferior. Reality: Compensating controls can be equally or even more effective than the original control, provided they are properly justified and documented.
8. Exam Tips: Answering Questions on Baseline Controls Identification and Documentation
Tip 1: Always Start with Categorization
If an exam question asks about control selection, remember that categorization always comes first. You cannot select a baseline without knowing whether the system is low, moderate, or high impact. If the scenario doesn't mention categorization, it may be testing whether you recognize this prerequisite step.
Tip 2: Know the High-Water Mark Principle
Many questions test your understanding of how the overall system impact level is determined. Remember: it is the highest impact value among C, I, and A. For example, if a system is categorized as (Low, Moderate, Low), the overall categorization is Moderate.
Tip 3: Distinguish Between Scoping, Tailoring, and Overlays
These terms are frequently confused in exam questions. Scoping removes non-applicable controls. Tailoring is the broader process that includes scoping, compensating controls, parameter assignment, and supplementation. Overlays are community-specific or technology-specific additions or modifications to baselines.
Tip 4: Understand Control Types (Common, Hybrid, System-Specific)
Exam questions often present scenarios and ask you to classify a control. Ask yourself: Is this control provided by the organization for all systems (common), partially shared (hybrid), or unique to one system (system-specific)?
Tip 5: Documentation Is Always Required
If an exam question provides a scenario where a control is removed, replaced, or modified, the correct answer almost always requires that the decision be documented and justified. The SSP is the primary document for recording control decisions.
Tip 6: Recognize the Role of the Authorizing Official
The authorizing official (AO) must accept the risk associated with tailoring decisions. If a question asks who approves the final set of controls after tailoring, the answer is the AO (or their designated representative).
Tip 7: Know Key NIST Publications
Be prepared to identify which publication provides what:
• FIPS 199 – Security categorization
• FIPS 200 – Minimum security requirements
• NIST SP 800-53 – Full catalog of security and privacy controls
• NIST SP 800-53B – Control baselines
• NIST SP 800-53A – Assessment procedures for controls
• NIST SP 800-37 – The RMF process itself
Tip 8: Watch for Distractor Answers
Common distractors include answers that suggest skipping tailoring, applying controls without categorization, or selecting controls based solely on cost rather than risk. Always choose the answer that follows the structured, risk-based approach defined by the RMF.
Tip 9: Compensating Controls Require Justification
If a question involves replacing a baseline control with a compensating control, the correct answer will emphasize that the compensating control must provide equivalent or greater protection and the rationale must be documented.
Tip 10: Think in Terms of Risk
Ultimately, baseline controls identification is about managing risk. The exam expects you to understand that control selection is driven by the system's risk profile, not by a mechanical application of a checklist. Every tailoring decision should reduce risk to an acceptable level as determined by the organization and accepted by the AO.
9. Summary
Baseline controls identification is a critical process in the security control selection phase of the RMF. It begins with system categorization (FIPS 199), proceeds to selecting the appropriate baseline (NIST SP 800-53B), and requires thoughtful tailoring to align controls with the organization's unique risk environment. Thorough documentation in the SSP and related artifacts ensures traceability, accountability, and audit readiness. For exam success, focus on understanding the logical sequence of activities, the distinctions between control types, the tailoring process, and the importance of documentation and risk-based decision-making.
