What is a well-defined, documented, and approved specification that describes the approved configuration of an information system?

What is a well-defined, documented, and approved specification that describes the approved configuration of an information system?

• A. System Security Plan
• B. Risk Matrix
• C. Baseline
• D. Minimum Security Requirements

Answer: (C)

A well-defined, documented, and approved specification that describes the approved configuration of an information system is known as a baseline. In the context of information security, a baseline establishes the expected security posture and settings for a system, ensuring consistency and compliance with the organization's policies and regulatory requirements. A baseline serves as a foundational reference, outlining the minimum security requirements and configurations for systems, applications, and networks. By establishing these specifications, organizations can effectively manage their security controls and monitor for deviations from the established standard, which is crucial for maintaining the integrity and confidentiality of information. Other choices do not fit the definition as accurately: a System Security Plan outlines the security requirements but does not specify configurations; a Risk Matrix assesses potential risks and their severity rather than defining configurations; and Minimum Security Requirements provide basic security needs but not the detailed specifications related to an information system's configurations. Therefore, the baseline represents a clear and documented standard for system configuration in security management.

A well-defined, documented, and approved specification that describes the approved configuration of an information system is known as a baseline. In the context of information security, a baseline establishes the expected security posture and settings for a system, ensuring consistency and compliance with the organization's policies and regulatory requirements.

A baseline serves as a foundational reference, outlining the minimum security requirements and configurations for systems, applications, and networks. By establishing these specifications, organizations can effectively manage their security controls and monitor for deviations from the established standard, which is crucial for maintaining the integrity and confidentiality of information.

Other choices do not fit the definition as accurately: a System Security Plan outlines the security requirements but does not specify configurations; a Risk Matrix assesses potential risks and their severity rather than defining configurations; and Minimum Security Requirements provide basic security needs but not the detailed specifications related to an information system's configurations. Therefore, the baseline represents a clear and documented standard for system configuration in security management.