The baseline check verifies whether an asset meets your organisation's minimum requirements before it goes into operation. The owner answers the requirements that apply to the asset's category and submits them for approval. This guide is aimed at asset owners, approvers and ISMS managers.

When the baseline check applies

  • For assets whose top-level category has Baseline check required set. This is preset for IT assets, buildings, suppliers and your organisation's asset, but not for information & processes.
  • As long as the baseline check is active. New organisations start with it active. The ISMS managers can switch it off after a dialog has explained the consequences.
  • If a system processes information, the baseline check only starts after the protection requirements assessment has been approved.
  • A status such as “In operation” can only be selected once there is an approved version.

Before you start (ISMS managers)

  1. Open ISMS settings › Assets › Baseline check.
  2. Under Requirement catalogue, assign at least one catalogue. Suitable are custom catalogues (in all plans) or standard catalogues such as NIST SP 800-53 or ICT baseline protection (Switzerland) (from the Pro plan). ISO/IEC 27001 Annex A is not possible here: you implement it through risk treatment and the Statement of Applicability.
  3. Check the Implementation status values. Each status has a type: fulfilled, partial, not fulfilled or not applicable.
  4. Define the Approval workflow: which functional roles approve at which step, with at least one approver.
  5. Under Validity, define how many months an approval is valid and how many days beforehand the owner is reminded. Without an entry, it is valid indefinitely.
  6. Under ISMS settings › Assets › Asset structure, use Define requirements for each category to define which requirements apply. See Adjusting the asset structure.

Baseline by protection requirement

For catalogues with baselines such as NIST SP 800-53, the selection also depends on the protection requirement of the asset: the highest protection requirement of the asset or of the information it processes is decisive: normal results in the Low baseline, high in Moderate, very high in High. If the asset processes personal data, the Privacy baseline also applies. Individually defined requirements always apply, regardless of the baseline. For your organisation's asset, the highest protection requirement of your organisation counts, and only the organisation-wide requirements apply.

  1. OwnerAnswer requirements

    Implementation status and description per requirement, evidence as PDF.

  2. OwnerTreat deviations

    Partially fulfilled or not fulfilled: measure or approved exception.

  3. ApproversApprove

    Never the person who answered, uploaded evidence or submitted.

  4. Version valid

    After that, the asset can go “In operation”.

Rejected

With a justification, optionally with feedback per requirement; after resubmission, each approver checks the corrections.

Validity expiring

The owner receives the task “Baseline check expiring” and starts a new round with “Start revision”.

The baseline check up to a valid version

The owner answers the requirements of their category with an implementation status and attaches evidence if necessary. The owner treats partially fulfilled or unfulfilled requirements with a measure or an approved exception. The approvers approve, never the person who answered, uploaded evidence or submitted. The last approval creates a version, after which the asset can go into operation. If it is rejected, the owner revises the answers; before the validity expires, the owner starts a revision.

How to proceed (owners)

  1. Open the task Carry out baseline check or, on the asset page, the Baseline check card in the Workflows tab.
  2. For each requirement, choose an Implementation status and describe how it is implemented or why not. Attach evidence as PDF if necessary.
  3. If a requirement is only partially fulfilled or not fulfilled, define the treatment: Will be fixed – measure (link an existing one or create a new one) or Stays as it is – request exception.
  4. Click Submit for approval. Every deviation must be treated, and every exception must be approved and valid.

What happens next

  • The approvers receive the task Approve baseline check. Answers and evidence are locked during approval.
  • Anyone who answered requirements, uploaded evidence or submitted cannot approve (four-eyes principle).
  • An approver can send it back with Reject and a justification, optionally with feedback per requirement. After resubmission, each approver checks the corrections with Check corrections.
  • The last approval creates a version with answers, signatures and evidence. After that, the asset can go “In operation”.
  • Before the validity expires, the owner receives the task Baseline check expiring and starts a new round with Start revision. If the requirements of the category change, the task Adapt baseline check to changed requirements follows.

If no requirements apply

If the baseline check page shows no requirements, it states the reason:

  • The asset has no category: assign a category under Edit
  • No catalogue in the baseline check: assign a catalogue in the baseline check settings
  • Nothing defined for the category: Define requirements for the category
  • Requirements outside the assigned catalogues or no longer active: check the requirements of the category
  • No requirement matches the protection requirement: if necessary, define individual requirements that apply regardless of the baseline

Until this is resolved, the baseline check waits. The owner receives no task, and submitting is blocked. Anyone who may not change the setting sees that the ISMS managers define it.

Frequently asked questions

What happens to open deviations?

A measure does not have to be implemented for submission, but it must be defined. An exception must be approved. With an exception, your organisation consciously accepts the deviation as a risk; justify it accordingly. See Implementing and evidencing measures.

Can an approver see the asset?

Yes. Approvers see the baseline check even without permission for the inventory.