Which term refers to taking an accurate account of a system's desired standard state so changes can be quickly detected for approval or remediation?

Baselining is the process of establishing and documenting a known, trusted, and secure state for a system or network. This "baseline" serves as a reference point. By continuously monitoring the system against this baseline, any deviations or changes can be quickly identified. This allows security teams to investigate whether a change was authorized (e.g., an approved patch) or unauthorized (e.g., malicious activity), enabling proper approval or remediation actions. This practice is a fundamental component of configuration management and security monitoring.

B. Patch management: This is the specific process of identifying, testing, and applying software updates (patches) to systems, not the broader process of documenting a standard state.

C. Deployment: This refers to the process of installing and configuring a system or application for operational use, which precedes the creation of a baseline for ongoing monitoring.

D. Capacity management: This discipline focuses on ensuring that IT resources are sufficient to meet current and future performance and availability requirements, not on tracking configuration changes.

1. National Institute of Standards and Technology (NIST) Special Publication 800-128

Guide for Security-Focused Configuration Management of Information Systems. Section 2.2

"Configuration Management Terms

" defines a configuration baseline as "The set of specifications for an information system...that has been formally reviewed and agreed on at a given point in time

and which can be changed only through change control procedures."

2. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations. Control CM-2

"Baseline Configuration

" states that the organization must "develop

document

and maintain...a current baseline configuration of the information system." The discussion section clarifies that this is used to manage and control changes to the system.

3. Carnegie Mellon University

Software Engineering Institute (SEI)

Configuration Management. The SEI defines a baseline as a "formally accepted version of a configuration item." It emphasizes that baselines serve as the basis for further development and can only be changed through formal change control procedures

which directly aligns with the question's intent. (Reference: CMMI for Development

Version 1.3

November 2010

p. 249).