This chapter is about creating a secure configuration baseline. Remember that security is a journey, and you can’t do everything at once. This is why risk management is so important—being able to weigh your risks, impacts, likelihood, and budget considerations. The company you work for is a business, so you have to balance controls, risk, and budget. As far as executive management goes, they aren’t going to care as much about security as you do. We will discuss how to decide what controls should be enforced and what security baseline you should follow. Next, we’ll discuss CIS and STIGs, why to choose either one and the best way to go about deploying your new security baseline.

In this chapter, we’re going to cover the following main topics:

• Security baseline
• System and Organizational Controls (SOC) 2
• Creating your security baseline