--- title: "Compliance framework baselines" description: "How Outpost's built-in baseline profiles turn a compliance framework into settings, which floors your own profiles cannot weaken, and how to choose frameworks." url: "https://support.outpostplatform.com/compliance/framework-baselines/" product: "depot" type: "concept" status: "draft" ai_summary: "Framework baselines are locked built-in profiles. Eight are contractual (SOC 2, HIPAA, PCI DSS 4.0, CJIS, NIST 800-171, NIST 800-53, CMMC L2, ISO 27001): assigning one declares the framework and makes its catalog values floors no profile can weaken. DISA STIG and the Microsoft baseline are advisory settings profiles. CIS ships no content. Chosen in setup or Profiles." availability: plans: ["home-lab", "essentials", "enterprise", "msp"] platforms: ["windows", "linux", "macos"] permission: "profile:manage" preview: false source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/compliance/framework-baselines.md" license: "CC BY 4.0" --- # Compliance framework baselines A baseline is a built-in profile that implements a compliance framework. When you assign one, Outpost holds every endpoint in its scope to that framework's minimum settings and starts measuring those endpoints against it. This page explains the two kinds of baseline, how a floor works, and how to choose your frameworks. It is for whoever decides which frameworks your organization is held to, and for technicians who need to know why a setting will not go lower. ## What a baseline is Outpost ships one built-in profile per framework. Each appears under **Profiles** > **All profiles** with the **Built-in baseline** chip. | Profile | Framework | Kind | | --- | --- | --- | | **SOC 2 Baseline** | SOC 2 | Enforced | | **HIPAA Baseline** | HIPAA Security Rule | Enforced | | **PCI-DSS Baseline** | PCI DSS 4.0 | Enforced | | **CJIS Baseline** | CJIS Security Policy | Enforced | | **NIST 800-171 Baseline** | NIST SP 800-171 | Enforced | | **NIST 800-53 Baseline** | NIST SP 800-53 Rev 5 | Enforced | | **CMMC Level 2 Baseline** | CMMC Level 2 | Enforced | | **ISO 27001 Baseline** | ISO/IEC 27001 | Enforced | | **DISA STIG Hardening** | DISA STIG | Advisory | | **Microsoft Security Baseline** | Microsoft security baseline | Advisory | Built-in baselines are locked. You can assign and unassign them, but you cannot edit their settings. Their content comes from the Outpost settings catalog and updates with the product, and each update is recorded in the audit log. There is no CIS Benchmarks profile. CIS content is licensed, so Outpost lists the framework and ships no settings for it. ## Enforced frameworks and floors The eight enforced baselines each set one thing: they declare that the endpoints in their scope are audited against that framework. Declaring a framework turns every value the settings catalog cites for it into a floor. A floor is the least strict value a setting may resolve to. Outpost resolves an endpoint's policy in three passes: 1. Ordinary profile assignments, in rank order. The highest rank wins. 2. Mandatory assignments, which no rank can beat. 3. Floors, for every framework declared on the endpoint. A floor clamps the result of the first two passes, including a mandatory value. So a profile can make a setting stricter than the floor but never weaker. If your profile sets a 30-minute screen lock and a framework's floor is 15 minutes, the endpoint gets 15 minutes. If your profile sets 5 minutes, the endpoint keeps 5. **Profiles** > **Effective config** shows which settings a floor changed, and from what value. What "stricter" means depends on the setting: | Kind of setting | What the floor does | | --- | --- | | A security feature that must be on, such as a firewall profile | Forces it on. | | A feature that must be off, such as user software installs | Forces it off. | | A minimum, such as password length or history | Raises lower values to the floor. | | A maximum, such as screen lock timeout or password age | Lowers higher values to the floor. | | A choice from a list, such as a cipher | Moves weaker choices up to the floor's choice. | | A set of allowed directions, such as remote file transfer | Removes anything the floor does not allow. | ### When more than one framework applies Declared frameworks add up. An endpoint covered by two baselines, at any scopes, is held to both, and where both set a floor on the same setting the stricter floor wins. For example, PCI DSS 4.0's 15-minute screen lock and the CJIS Security Policy's 30-minute screen lock resolve to 15 minutes. A narrower assignment cannot remove a framework. If the **HIPAA Baseline** is assigned to your whole organization, no site, device group, or endpoint assignment can take an endpoint out of it. ### Retention floors Some floors apply to records Outpost keeps rather than to endpoints: - `compliance.endpoint_audit_retention_days` sets how long the **Endpoint changes** audit record is kept. See [Audit logs](/depot/audit-log/). - `compliance.evidence_retention_days` sets how long evidence packs are kept. See [Generate evidence packs](/compliance/evidence-packs/). Declaring HIPAA, for example, raises both to 2,190 days (six years). These two settings are resolved for your organization as a whole. ## Advisory frameworks **DISA STIG Hardening** and **Microsoft Security Baseline** work differently. Each is an ordinary settings profile built from every value the catalog cites for that benchmark. Assigning one applies those values like any other profile: a higher-ranked profile or a mandatory assignment can override them, and they set no floors. Assigning an advisory profile does not declare the framework, because nobody audits you against it. The **Compliance** overview shows DISA STIG, the Microsoft baseline, and CIS whether or not you assign anything, marked **advisory**, so you can see how your endpoints compare before you adopt one. An evidence pack for an advisory framework is a gap analysis, not a compliance claim, and says so. ## Where you see a framework's values In a profile's **Settings** tab, every setting a framework cites shows a badge with the framework, the control, and the value: **requires** for an enforced framework, **recommends** for an advisory one. Hover over the badge to read the citation, which names the control and explains how Outpost reads it. The full list, per framework, is in [Baseline settings by framework](/compliance/framework-settings/). ## Choosing your frameworks Every framework is available on every plan, Home Lab and Essentials included. Choose the frameworks you are contractually or legally held to. Each one you declare adds floors, and a floor you do not need is a setting you can no longer relax without an exception. **During first-run setup**, the **Compliance** step lists the eight enforced frameworks and **CIS Benchmarks**. Each framework you select has its baseline assigned to your whole organization. Selecting **CIS Benchmarks** puts nothing in force. See [Set up your Outpost](/depot/first-run-setup/). **Later**, open the baseline under **Profiles** > **All profiles**, open the **Assignments** tab, and select **Assign this profile**. Under **Applies to**, choose **Whole client** for your whole organization, or a **Site**, **Device group**, or **Endpoint**. Assigning a profile needs `profile:manage`. To stop declaring a framework, select **Unassign** on its assignment. DISA STIG and the Microsoft baseline are assigned this way only, because the setup wizard does not list them. Assigning a framework changes settings on every endpoint in scope at its next policy update. Review [Baseline settings by framework](/compliance/framework-settings/) first, in particular the settings for password policy, account lockout, screen lock, remote access, and software installation, which users notice. :::note No framework turns on local administrator password rotation. Selecting a framework never starts changing passwords on your endpoints. See [Rotate local administrator passwords](/compliance/local-admin-rotation/). ::: ## Limits - Floors cover the endpoint settings Outpost manages. A framework's controls for people, processes, and systems outside Outpost are not represented. - A value the catalog cites is Outpost's reading of the control. Where a standard names no number, the citation says so and explains the value chosen. Check the citations against your own interpretation and your auditor's. - No baseline requires session recording, so assigning a framework does not record remote sessions. Where your own policy or your auditor asks for recorded sessions, turn recording on in a profile. Recording needs Enterprise or MSP. See [Record remote sessions](/remote-access/session-recording/). - A setting a platform cannot express is reported as **Not measured** on that platform, not as a gap. FreeBSD and OpenBSD endpoints are not measured. ## Related - [Baseline settings by framework](/compliance/framework-settings/) - [Review compliance posture](/compliance/compliance-overview/) - [Request and approve exceptions](/compliance/exceptions/) - [Automation](/automation/)