Establishing security baseline is the starting point to a better security program.

In the CSQA Common Body of Knowledge (CBOK) the first operational activity recommended for maturing an organisational security programme is to “define and document an information-security baseline,” i.e., the minimum set of controls that every application, platform, and business unit must meet. All subsequent planning, gap analysis, control selection and continuous-improvement activities are performed against that formally agreed baseline; therefore, without it there is no objective point of reference from which to measure progress or compliance. In short, the baseline is explicitly identified in the CSQA syllabus as the starting point for building and improving a security programme. Why the “False” option is wrong: Answering “False” would contradict the CSQA CBOK guidance, which states that establishing the baseline precedes all other security-assurance tasks. If an organisation tried to improve security before agreeing on its baseline, there would be no consistent yard-stick for determining what “better” actually means, defeating the purpose of an improvement programme.

1. QAI Global Institute. “Certified Software Quality Analyst (CSQA) Common Body of Knowledge,” Version 2022, Chapter 8 “Security Assurance,” §8.2 “Establishing the Security Baseline,” pp. 364-365.

2. Carnegie-Mellon University, Software Engineering Institute. Course notes for “Secure Software Engineering” (2021), Lecture 3: “Security Baselines and Control Frameworks,” slides 7-9.

3. Massachusetts Institute of Technology OpenCourseWare, 6.858 “Computer Systems Security,” Lecture 1 notes, section “Security Baselines,” para 3 (2020).