A baseline characterizes expected system or user behavior so security teams can recognize meaningful deviations and evaluate improvement. section 8.4.1 section 11.1.1
Build a useful baseline through a recurring measurement cycle:
- Collect sufficient historical data, such as six months of throughput or other maintained logs. section 8.4.1
- Analyze behavior with weekly percentiles, means, standard deviations, positivity rates, or log-scale slopes. section 8.4.1
- Set investigation thresholds, such as mean plus two standard deviations, then review false positives and adjust them. section 8.4.1
- Compare current performance with the baseline to assess whether security measures improved results. section 11.1.1
Patching and threat detection
A team records how often patching finishes on time and how many vulnerabilities it identifies. After deploying a new intrusion detection system, it compares detection rates with historical performance to test whether the change improved outcomes. section 11.1.1
