Endpoints · Compliance
Security Baselines
Pre defined, vetted configuration sets that establish a known good hardened state for an operating system or application.
IntermediateUpdated 2026-09-01
Overview
Baselines from Microsoft, CIS and DISA STIGs encode hundreds of settings with rationale. Adopting a published baseline and documenting deviations is far more defensible than assembling settings ad hoc.
Baselines must be versioned and reviewed: new OS releases change available settings, and unmanaged drift accumulates quickly across an estate.
Security considerations
- Pilot baselines before broad deployment; some settings break legacy applications.
- Record every deviation with a justification, owner and review date.