CIRSEC Baselines · open content

How to configure it securely.
Written from primary sources, free to reuse.

Each baseline is a set of controls for one product: the desired setting, why it matters, what it breaks, how to check it by hand or with a scanner, how to fix it. Released under CC BY 4.0, so anyone can use it, commercial products included.

CC BY 4.0Versioned per standardProfiles & parametersOpen sources only

The baselines

2 standards

Cloud & SaaS

Baselines for cloud platforms and SaaS tenants.

Standard	Applies to	Controls	Release
Microsoft 365 tenant`CB-M365-…`	Microsoft 365	0	draft v0.1.0

Operating systems

Baselines for server and workstation operating systems.

Standard	Applies to	Controls	Release
Debian GNU/Linux`CB-DEB-…`	Debian GNU/Linux 12, 13	0	draft v0.1.0

An identifier that never moves

A control is never renumbered, never moved to another domain, and its number is never reused. When its meaning must change, it is deprecated and replaced by a new one that says so.

Principles

Clean room

Controls are written from vendor documentation, RFCs and public-domain guides only, never with a proprietary benchmark open. Every control lists its sources.

ii.

Open sources only

No paywalled benchmark, no proprietary standard. A control links to public frameworks (NIST SP 800-53, CISA SCuBA, ANSSI) and to MITRE ATT&CK, CWE and CVE through typed mappings.

iii.

Customizable

Profiles replace "Level 1 / Level 2", and tunable values are parameters with per-profile defaults: an organization adapts a baseline without forking it.

What a control holds

Title and finding: The rule as the desired state, and how its failure reads in a report: Block user consent to third-party applications fails as Users can grant third-party apps access to company data.
Risk and profiles: A severity from info to critical, and the profiles that apply it. hardened extends baseline: it applies every baseline control too.
Audit and remediation: A manual procedure always, and machine checks per engine (Graph API, PowerShell, shell, osquery, registry...). Scanners report each check by its id.
Mappings and threats: How it relates to other frameworks (equivalent, stricter, partial...), and the ATT&CK techniques, CWEs or CVEs it mitigates. See frameworks.
Provenance: Authors, reviewers, tests against real environments, and the release that introduced it. History lives in git, every commit signed off.