# CIRSEC Baselines

> Open, free and versioned security configuration baselines (cloud tenants, operating systems, network devices, software), written from primary sources and released under CC BY 4.0. Each recommendation is a control, CB-<STANDARD>-<DOMAIN>-<NNN>, never renumbered nor reused.

A control states the desired setting (`title`) and how its failure reads in a report (`finding`), its risk, the profiles applying it (`hardened` extends `baseline`), tunable parameters referenced as {{ name }}, manual and automated audit checks per engine, remediation, the primary sources it was written from, and typed mappings to other frameworks (NIST SP 800-53, CISA SCuBA, ANSSI), all open sources.

- [Repository and format](https://github.com/cirsec/baselines): README, JSON Schemas, templates

## Pages

- [CIRSEC Baselines · Open security configuration baselines](https://baselines.cirsec.org/): Open, free and versioned security configuration baselines for cloud tenants, operating systems and software, written from open primary sources and mapped to public frameworks such as NIST, CISA and ANSSI.
- [Debian GNU/Linux · CIRSEC Baselines](https://baselines.cirsec.org/b/debian): Secure configuration baseline for Debian servers. Version-specific differences are handled per control with applicability.versions. 0 controls, CB-DEB.
- [Microsoft 365 tenant · CIRSEC Baselines](https://baselines.cirsec.org/b/m365): Secure configuration baseline for Microsoft 365 tenants (Entra ID, Exchange Online, SharePoint, OneDrive, Teams). 0 controls, CB-M365.
- [Frameworks and engines · CIRSEC Baselines](https://baselines.cirsec.org/frameworks): The frameworks CIRSEC Baselines controls map to (NIST SP 800-53, CISA SCuBA, ANSSI), the threat taxonomies they mitigate, and the engines their checks run on.
- [How it works · CIRSEC Baselines](https://baselines.cirsec.org/how-it-works): How a CIRSEC baseline works, shown on a deliberately silly demo: categories, standards, controls, profiles, parameters, audit checks, lifecycle and releases.