(ISC)2 Certified in Cybersecurity Practice Exam

What is a security baseline in an organization?

1. A set of minimum security requirements that must be met by an organization's systems and networks

2. A guideline for conducting security audits

3. An inventory of all security software in use

4. A policy for managing user access

The correct answer is: A set of minimum security requirements that must be met by an organization's systems and networks

A security baseline is best defined as a set of minimum security requirements that must be met by an organization's systems and networks. This framework establishes a standard that helps ensure that security measures are consistently applied across the organization's resources. By defining these minimum security requirements, organizations can maintain a baseline of security posture that must be adhered to, helping to protect assets and information from various threats. Establishing a security baseline is crucial as it allows organizations to assess their current security measures, identify gaps, and implement the necessary actions to improve their security framework. It also serves as a reference point for future audits and assessments, ensuring that any updates to security policies or procedures are made with the baseline in mind. The other options, while related to security practices, do not encapsulate the concept of a security baseline. Guidelines for conducting security audits focus on the processes and procedures for reviewing security measures rather than defining minimum requirements. An inventory of all security software in use pertains to tracking assets and tools, which is valuable but does not establish a minimum standard of security. A policy for managing user access addresses specific security challenges concerning user permissions, rather than providing a broad security baseline applicable across the organization.