What are security control baselines in RMF?

• A. Predefined groups of controls for each impact level used as a starting point in Step 2.
• B. A comprehensive list of all possible controls for all systems.
• C. A set of organizational policies governing data handling.
• D. A method for measuring control performance during operation.

Answer: (A)

Security control baselines are predefined groups of security controls aligned to impact levels that provide the starting point for selecting controls in RMF Step 2. They come from guidance like NIST SP 800-53 and reflect the typical controls needed for systems categorized as Low, Moderate, or High impact. Organizations tailor these baselines to their environment, adding or adjusting controls to address specific risks and mission requirements before proceeding with implementation and assessment. They are not an all-encompassing list of every possible control for every system, they are not organizational data-handling policies, and they do not measure control performance—that happens later during assessment and continuous monitoring.