Episode 10 — Select Appropriate Security Baselines
In this episode, we show how to select and tailor the correct control baseline for your system’s categorized impact level, then connect that selection to FedRAMP’s specific parameter settings and documentation expectations. We begin by reviewing how baseline choice flows from FIPS 199, and we outline the differences in control emphasis across Low, Moderate, and High, including logging depth, identity assurance, cryptographic requirements, and resilience measures. We describe how FedRAMP overlays and parameter values modify underlying NIST controls, and why recording those choices precisely in the SSP prevents ambiguous testing. We also cover when FedRAMP Tailored and additional overlays may be appropriate, ensuring you neither under- nor over-scope your implementation.
We then walk through a practical tailoring process. Start by confirming inheritance sources, capture any compensating controls with clear risk rationale, and set parameters in ways that your operations can consistently demonstrate. Align evidence planning with each control family so authenticated scans, configuration exports, and operational logs can prove implementation during assessment and in monthly submissions. We close with troubleshooting guidance for misaligned baselines, such as discovering late that a dependency enforces stricter requirements, or that a customer integration adds identity assertions not covered in your initial plan. Selecting and documenting the right baseline turns scattered requirements into an implementable, testable, and maintainable security architecture. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.
