IT Security Baseline Assessment: How to Know Where You Stand Before the Auditor Arrives

What is a Security Baseline Assessment?

A security baseline assessment is a structured evaluation of your current IT security controls against a defined standard — ISO/IEC 27001:2022, CERT-In Directions 2022, CIS Controls v8, or the RBI Cybersecurity Framework — that produces a scored, gap-by-gap view of your compliance posture. It is the essential first step before any formal certification or regulatory audit. The purpose is to identify gaps while you still have time to close them. A baseline assessment done 90 days before your ISO 27001 certification audit gives you time to remediate high-priority findings. One done the week before is too late. For CERT-In, there is no scheduled audit — a cyber incident can trigger a mandatory audit at any time. Baseline readiness is therefore a continuous, not periodic, requirement.

What Evidence to Collect

A baseline assessment must be evidence-based — not self-reported. The difference between "we have a patch management process" and demonstrable compliance is the evidence artefacts: the documented policy, the vulnerability scan report, the patch deployment log, the exception register. For each control area, collect: the policy document (version, approval date), a recent evidence artefact (scan report, log extract, test result), and the name of the control owner. Controls with no evidence are automatically rated as non-compliant, regardless of what actually happens in practice.

Scoring Your Baseline

• Implemented (2 points): Policy exists, evidence of execution exists, control is working as designed.
• Partial (1 point): Policy exists but incomplete, or evidence is stale, or control is only applied to some systems.
• Missing (0 points): No policy, no evidence, or control is known to not be in place.

Score each domain separately — Access Control, Patch Management, Network, Backup, Endpoint, Physical, Documentation. A domain score below 60% is a material gap. Below 40% is a critical gap that requires immediate remediation before any formal audit.

Remediation Prioritisation

Not all gaps are equal. Prioritise remediation based on: regulatory obligation (CERT-In mandatory controls first), exploitability (gaps with known active exploits), blast radius (gaps that would allow lateral movement or data exfiltration), and time to close (quick wins vs multi-month projects). Build a 90-day remediation roadmap — showing which critical gaps will be closed by when, who owns each item, and what the measurable outcome is. This roadmap, presented to the board, is itself evidence of governance maturity.