Security control baseline defines minimum standards for which information?

• A. Low impact, moderate impact, or high-impact information
• B. Public, internal, confidential information only
• C. Personal, financial, health data only
• D. Operational, tactical, strategic information

Answer: (A)

A security control baseline sets the minimum protections for information based on its potential impact on the organization if compromised. The standard approach is to categorize information systems by impact levels—low, moderate, or high—and apply a baseline of security controls appropriate to that level. This ensures a consistent, risk-based floor for safeguards across systems handling information with similar sensitivity. It’s not about labeling data as public/internal/confidential, nor about specific data types (personal, financial, health), or about organizational usage levels (operational, tactical, strategic). The minimum standards correspond to the information’s impact level, making low, moderate, or high impact information the correct fit.