[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcm-2":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cm-2","CM-2","Baseline Configuration",100,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must develop, document and maintain a current baseline configuration of the system under configuration control, and review and update it at defined times and when components change.\n\n**In practice.** This means version-controlled build standards or infrastructure-as-code templates describing approved configurations, software versions and network settings. Changes to the baseline go through change management and deployed systems are compared against it. Auditors expect baseline documents or code, change history and drift reports. CIS Control 4 and ISO\u002FIEC 27001 configuration management carry the same idea. Keeping previous baselines supports rollback and investigation.\n\n**Common gaps.** Baselines are often written once and not updated, so they no longer match reality. Systems built manually outside the standard process create unknown configurations. Cloud resources changed directly in consoles also drift away from their templates.","a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and\n  b. Review and update the baseline configuration of the system:\n    1. [Assignment: organization-defined frequency];\n    2. When required due to [Assignment: organization-defined circumstances] ; and\n    3. When system components are installed or upgraded.\nDiscussion: Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"npm-trusted-publishing-flaw-exposed-1500-packages-to-hijacking","npm Trusted Publishing Flaw Exposed 1,500+ Packages to Hijacking","2026-10-13T18:21:16.112+00:00",{"slug":25,"title":26,"published_at":27},"ai-powered-ransomware-automates-azure-tenant-destruction","AI-Powered Ransomware Automates Azure Tenant Destruction","2026-09-28T18:20:53.034+00:00",{"slug":29,"title":30,"published_at":31},"placeholder-domain-hijacked-to-serve-malware-across-1700-repos","Placeholder Domain Hijacked to Serve Malware Across 1,700+ Repos","2026-09-24T20:22:59.685+00:00",{"slug":33,"title":34,"published_at":35},"ai-security-test-bleeds-into-live-systems-after-domain-name-collision","AI Security Test Bleeds Into Live Systems After Domain Name Collision","2026-09-19T10:20:36.682+00:00",{"slug":37,"title":38,"published_at":39},"ai-model-escapes-sandbox-via-misconfiguration-accesses-real-systems","AI Model Escapes Sandbox via Misconfiguration, Accesses Real Systems","2026-09-10T12:20:26.292+00:00",{"slug":41,"title":42,"published_at":43},"ai-safety-test-escapes-sandbox-attacks-real-company-due-to-naming-error","AI Safety Test Escapes Sandbox, Attacks Real Company Due to Naming Error","2026-08-17T14:20:56.634+00:00",{"slug":45,"title":46,"published_at":47},"ai-agents-escape-sandboxes-due-to-config-errors-and-unpatched-flaws","AI Agents Escape Sandboxes Due to Config Errors and Unpatched Flaws","2026-08-04T12:21:44.608+00:00",{"slug":49,"title":50,"published_at":51},"ai-test-environment-misconfiguration-leads-to-real-world-system-compromise","AI Test Environment Misconfiguration Leads to Real-World System Compromise","2026-07-31T22:21:25.918+00:00",{"slug":53,"title":54,"published_at":55},"ai-model-breaches-real-systems-after-misconfiguration-grants-unintended-internet-access","AI Model Breaches Real Systems After Misconfiguration Grants Unintended Internet Access","2026-07-31T12:22:57.221+00:00",{"slug":57,"title":58,"published_at":59},"automated-maintenance-bug-triggers-massive-microsoft-365-outage","Automated Maintenance Bug Triggers Massive Microsoft 365 Outage","2026-07-24T16:20:20.983+00:00",{"slug":61,"title":62,"published_at":63},"ai-model-with-disabled-safeguards-exploits-zero-day-to-compromise-hugging-face","AI Model with Disabled Safeguards Exploits Zero-Day to Compromise Hugging Face","2026-07-22T00:21:00.024+00:00",{"slug":65,"title":66,"published_at":67},"integrating-cicd-into-secops-strengthens-detection-resilience","Integrating CI\u002FCD Into SecOps Strengthens Detection Resilience","2026-07-21T16:20:40.536+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",44,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",31,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",24,{"slug":85,"name":86,"problem":87,"stories":88},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",20,{"slug":90,"name":91,"problem":92,"stories":93},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",17,{"slug":95,"name":96,"problem":97,"stories":98},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",15,[100,106,111,116,121,126,130,134],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",46,{"family":101,"item":107,"code":108,"title":109,"together":110},"12","Control 12","Network Infrastructure Management",42,{"family":5,"item":112,"code":113,"title":114,"together":115},"si-2","SI-2","Flaw Remediation",38,{"family":5,"item":117,"code":118,"title":119,"together":120},"ac-2","AC-2","Account Management",29,{"family":5,"item":122,"code":123,"title":124,"together":125},"ac-3","AC-3","Access Enforcement",27,{"family":101,"item":127,"code":128,"title":129,"together":83},"6","Control 6","Access Control Management",{"family":101,"item":131,"code":132,"title":133,"together":88},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":5,"item":135,"code":136,"title":137,"together":138},"ac-6","AC-6","Least Privilege",19]