NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PL-10, Baseline Selection, is the shortest requirement in the family: select a control baseline for the system.
The guidance defines a baseline as a predefined set of controls assembled to address the protection needs of a group, organization, or community. Baselines either satisfy mandates or address threats common to all users of the baseline. They are a starting point, with tailoring to follow under PL-11.
What it means in practice
A baseline is a decision you can point to. A federal system picks low, moderate, or high based on its security categorization, using the baselines in SP 800-53B. A commercial company may adopt the same baselines as a reference, or choose a different framework as its starting set and say so.
The part auditors care about is the record: which baseline, why, who approved it, and when.
Evidence to collect
- The categorization or risk rationale that led to the choice.
- The baseline document or control list adopted.
- Approval by the system owner or an accountable executive.
- Link to the system plan that references it.
Common gaps
- A baseline chosen informally and never written down.
- Different teams using different baselines for similar systems.
- No link between selection and the later tailoring record.
How to implement it
Decide your baseline per system or per class of system, record the rationale, and store it with the system plan. If a customer requires a specific framework, name it as a starting set and map the rest. Check any mapping between frameworks against an authoritative source, since mappings vary.
Try it yourself
The demo shows how one control set maps across several frameworks.
Click through it at your own pace, or open it full screen.
Quick check
Is a baseline the same as a framework?
A baseline is a selected starting set of controls. A framework is the catalog or standard it comes from. You can start from one framework and tailor.
