Compliance framework baselines

A baseline is a built-in profile that implements a compliance framework. When you assign one, Outpost holds every endpoint in its scope to that framework’s minimum settings and starts measuring those endpoints against it. This page explains the two kinds of baseline, how a floor works, and how to choose your frameworks. It is for whoever decides which frameworks your organization is held to, and for technicians who need to know why a setting will not go lower.

What a baseline is

Outpost ships one built-in profile per framework. Each appears under Profiles > All profiles with the Built-in baseline chip.

Profile	Framework	Kind
SOC 2 Baseline	SOC 2	Enforced
HIPAA Baseline	HIPAA Security Rule	Enforced
PCI-DSS Baseline	PCI DSS 4.0	Enforced
CJIS Baseline	CJIS Security Policy	Enforced
NIST 800-171 Baseline	NIST SP 800-171	Enforced
NIST 800-53 Baseline	NIST SP 800-53 Rev 5	Enforced
CMMC Level 2 Baseline	CMMC Level 2	Enforced
ISO 27001 Baseline	ISO/IEC 27001	Enforced
DISA STIG Hardening	DISA STIG	Advisory
Microsoft Security Baseline	Microsoft security baseline	Advisory

Built-in baselines are locked. You can assign and unassign them, but you cannot edit their settings. Their content comes from the Outpost settings catalog and updates with the product, and each update is recorded in the audit log.

There is no CIS Benchmarks profile. CIS content is licensed, so Outpost lists the framework and ships no settings for it.

Enforced frameworks and floors

The eight enforced baselines each set one thing: they declare that the endpoints in their scope are audited against that framework. Declaring a framework turns every value the settings catalog cites for it into a floor.

A floor is the least strict value a setting may resolve to. Outpost resolves an endpoint’s policy in three passes:

1. Ordinary profile assignments, in rank order. The highest rank wins.
2. Mandatory assignments, which no rank can beat.
3. Floors, for every framework declared on the endpoint. A floor clamps the result of the first two passes, including a mandatory value.

So a profile can make a setting stricter than the floor but never weaker. If your profile sets a 30-minute screen lock and a framework’s floor is 15 minutes, the endpoint gets 15 minutes. If your profile sets 5 minutes, the endpoint keeps 5. Profiles > Effective config shows which settings a floor changed, and from what value.

What “stricter” means depends on the setting:

Kind of setting	What the floor does
A security feature that must be on, such as a firewall profile	Forces it on.
A feature that must be off, such as user software installs	Forces it off.
A minimum, such as password length or history	Raises lower values to the floor.
A maximum, such as screen lock timeout or password age	Lowers higher values to the floor.
A choice from a list, such as a cipher	Moves weaker choices up to the floor’s choice.
A set of allowed directions, such as remote file transfer	Removes anything the floor does not allow.

When more than one framework applies

Declared frameworks add up. An endpoint covered by two baselines, at any scopes, is held to both, and where both set a floor on the same setting the stricter floor wins. For example, PCI DSS 4.0’s 15-minute screen lock and the CJIS Security Policy’s 30-minute screen lock resolve to 15 minutes.

A narrower assignment cannot remove a framework. If the HIPAA Baseline is assigned to your whole organization, no site, device group, or endpoint assignment can take an endpoint out of it.

Retention floors

Some floors apply to records Outpost keeps rather than to endpoints:

• compliance.endpoint_audit_retention_days sets how long the Endpoint changes audit record is kept. See Audit logs.
• compliance.evidence_retention_days sets how long evidence packs are kept. See Generate evidence packs.

Declaring HIPAA, for example, raises both to 2,190 days (six years). These two settings are resolved for your organization as a whole.

Advisory frameworks

DISA STIG Hardening and Microsoft Security Baseline work differently. Each is an ordinary settings profile built from every value the catalog cites for that benchmark. Assigning one applies those values like any other profile: a higher-ranked profile or a mandatory assignment can override them, and they set no floors.

Assigning an advisory profile does not declare the framework, because nobody audits you against it. The Compliance overview shows DISA STIG, the Microsoft baseline, and CIS whether or not you assign anything, marked advisory, so you can see how your endpoints compare before you adopt one. An evidence pack for an advisory framework is a gap analysis, not a compliance claim, and says so.

Where you see a framework’s values

In a profile’s Settings tab, every setting a framework cites shows a badge with the framework, the control, and the value: requires for an enforced framework, recommends for an advisory one. Hover over the badge to read the citation, which names the control and explains how Outpost reads it.

The full list, per framework, is in Baseline settings by framework.

Choosing your frameworks

Every framework is available on every plan, Home Lab and Essentials included. Choose the frameworks you are contractually or legally held to. Each one you declare adds floors, and a floor you do not need is a setting you can no longer relax without an exception.

During first-run setup, the Compliance step lists the eight enforced frameworks and CIS Benchmarks. Each framework you select has its baseline assigned to your whole organization. Selecting CIS Benchmarks puts nothing in force. See Set up your Outpost.

Later, open the baseline under Profiles > All profiles, open the Assignments tab, and select Assign this profile. Under Applies to, choose Whole client for your whole organization, or a Site, Device group, or Endpoint. Assigning a profile needs profile:manage. To stop declaring a framework, select Unassign on its assignment. DISA STIG and the Microsoft baseline are assigned this way only, because the setup wizard does not list them.

Assigning a framework changes settings on every endpoint in scope at its next policy update. Review Baseline settings by framework first, in particular the settings for password policy, account lockout, screen lock, remote access, and software installation, which users notice.

Note

No framework turns on local administrator password rotation. Selecting a framework never starts changing passwords on your endpoints. See Rotate local administrator passwords.

Limits

• Floors cover the endpoint settings Outpost manages. A framework’s controls for people, processes, and systems outside Outpost are not represented.
• A value the catalog cites is Outpost’s reading of the control. Where a standard names no number, the citation says so and explains the value chosen. Check the citations against your own interpretation and your auditor’s.
• No baseline requires session recording, so assigning a framework does not record remote sessions. Where your own policy or your auditor asks for recorded sessions, turn recording on in a profile. Recording needs Enterprise or MSP. See Record remote sessions.
• A setting a platform cannot express is reported as Not measured on that platform, not as a gap. FreeBSD and OpenBSD endpoints are not measured.

Related

• Baseline settings by framework
• Review compliance posture
• Request and approve exceptions
• Automation