---
title: "Security baselines"
description: "Adopt a framework baseline, see where an estate falls short of it, and produce the evidence an auditor will ask for."
url: "https://support.outpostplatform.com/guides/security-baselines/"
product: "depot"
type: "how-to"
status: "stub"
ai_summary: "Guide to security framework baselines in Outpost. A baseline is a locked profile derived from a published framework; the console reports the gap between it and what endpoints actually enforce, and packages the result as evidence for an audit."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/guides/security-baselines.md"
license: "CC BY 4.0"
---

# Security baselines

A framework tells you what your endpoints should enforce. A baseline in Outpost
is that framework as a locked profile, and the gap analysis is the difference
between it and what your endpoints actually do. This guide is for whoever has to
answer an auditor, or an insurer, or a customer's security questionnaire.

<!-- TODO: write this page against the how-to template.

Sections:

- Before you begin: the security permissions, and endpoints already reporting
  policy state.
- Which frameworks are available, and what a baseline covers of each.
- Adopting a baseline, and why the shipped profile is locked.
- Deriving your own profile from a baseline, and keeping the link.
- Reading a gap analysis: covered, gapped, and not applicable.
- Exceptions: recording a control you are deliberately not meeting, with a
  reason and an owner.
- Evidence packs: what goes in one, and handing it to an auditor.
- Keeping a baseline current when the framework is revised.
- If something goes wrong: a control that reports gapped on every endpoint,
  and evidence that will not generate.
-->

Follow the [how-to template](https://gitlab.com/outpostplatform/docs/-/blob/main/templates/how-to.md).