{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:0af32625b7fb0bd5d59150bc4d02bc9e6a537d1997191911212275676a044f27","slug":"controls-secure-baseline-integrity-drift-management","url":"/assets/agent_workflow-controls-secure-baseline-integrity-drift-management-cd0cea34.afc327ae5c33540c.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=controls-secure-baseline-integrity-drift-management","description":"Standing monthly operator workflow for the secure-baseline and integrity-drift cycle: maintain and approve hardening baselines and least-functionality settings against accepted industry standards, run configuration-compliance scanning and remediate drift as findings, triage file-integrity, hash/signature, and secure-boot alerts while verifying security functions self-test correctly, and keep the configuration management plan current annually or after significant environment change. In scope: system components and network security controls governed by CM-2/CM-6/CM-7/CM-9 and SI-6/SI-7 (ISO 27001 A.8.9, PCI DSS Req.1/Req.2, NIST CSF PR.PS-01/DE.CM-09). Out of scope: incident containment and response — unexplained changes are escalated as potentially adverse events to the detect-to-respond incident-analysis practice rather than contained here. Anchor: each monthly run is a recurring workflow instance attached to the EXISTING secure-configuration Control item (the CM-2/CM-6/CM-7 hardening-baseline control — domains=secure_configuration_change_management, frequency=monthly, framework nist-800-53/pci-dss/iso-27001); the cycle enriches that standing Control and never creates a new one. No upstream workflow feeds this cycle — it is self-seeding: its inputs are the prior instance's archived operating record, the approved hardening-baseline standards (Policy items linked to the Control), the open drift/integrity backlog and baseline-reassessment carry-forward (Issue items linked to the anchor Control), and the CM-plan review calendar. Named deliverables: the approved hardening-baseline standards and least-functionality list, the configuration-compliance scan-result register, the integrity-alert and self-test register, drift and corrective-action findings (Issue items linked to the Control), the reviewed configuration management plan (Policy item), the cycle-health dashboard and readiness summary, and the signed, archived cycle operating record. The only cross-workflow handoff is the adverse-event escalation package handed to the detect-to-respond incident-analysis practice.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=controls-secure-baseline-integrity-drift-management","capabilities":[],"controls":["UC-CONFIG-01","UC-CONFIG-09","UC-VULN-06"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:0af32625b7fb0bd5d59150bc4d02bc9e6a537d1997191911212275676a044f27","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-secure-baseline-integrity-drift-management","standards":["nist-800-53","nist-csf-2","pci-dss","iso-27001"],"teams":["it"]},"id":"wf:C42","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AC42","slug":"controls-secure-baseline-integrity-drift-management","sourceIds":["coso-ic","iso-27001","nist-800-53","nist-csf-2","pci-dss","soc2"],"sourceUrl":null,"title":"Secure Baseline & Integrity Drift Management","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3b26e94b700880beb32e18f95ddf00ad9d0fc5fcc1b55fc76d62f1c7c798eabf","properties":{},"sourceDetailPath":"/data/v1/records/wf-c42-b0991cdd.json","sourceId":"wf:C42","targetDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","targetId":"uc:UC-CONFIG-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:780969ece294077a0a3eb6766c5c9bec461c5012a735ef1dac1cf1200b143bca","properties":{},"sourceDetailPath":"/data/v1/records/wf-c42-b0991cdd.json","sourceId":"wf:C42","targetDetailPath":"/data/v1/records/uc-uc-vuln-06-3863b890.json","targetId":"uc:UC-VULN-06","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c5a0abd0f44091c916d1ebca5f3334bc24ef1624e00e5e6c020616c28f420451","properties":{},"sourceDetailPath":"/data/v1/records/wf-c42-b0991cdd.json","sourceId":"wf:C42","targetDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","targetId":"uc:UC-CONFIG-01","type":"operates"}],"schemaVersion":1}