Security Baseline

Minimum controls should be clear enough to verify.

The Blackpine Security Baseline is a practical starting point for smaller and mid-sized organizations. It is not a certification and it does not replace requirements that apply to a specific industry, contract, or risk profile.

Identity

Minimum expectation: Every business-critical identity has a named owner and a controlled recovery path.
Why it matters: Account ownership and recovery determine who can regain control when ordinary authentication fails.
How to verify: Sample privileged, shared, and recovery accounts and verify owner, MFA, recovery method, and last review.

MFA

Minimum expectation: Privileged and remote access uses strong MFA, with exceptions documented and reviewed.
Why it matters: A password alone should not be enough to exercise broad administrative control.
How to verify: Export authentication policy and compare privileged accounts against enforced methods and exceptions.

Privileged access

Minimum expectation: Administrative roles are limited, attributable, and reviewed.
Why it matters: Broad or stale privilege increases the consequence of one compromised identity.
How to verify: Enumerate privileged roles, permanent assignments, shared accounts, and recent role changes.

Email

Minimum expectation: External forwarding, delegation, mail authentication, and recovery settings are controlled.
Why it matters: Email is often both a communication channel and a recovery path for other systems.
How to verify: Review forwarding, inbox rules, delegates, SPF, DKIM, DMARC, and privileged mail administration.

Domains & DNS

Minimum expectation: Registrar and DNS control is owned, strongly authenticated, and recoverable.
Why it matters: Domain control can redirect websites, mail, and trust relationships at once.
How to verify: Verify registrar ownership, MFA, recovery contacts, DNS administration, and change notification.

Endpoints

Minimum expectation: Supported devices receive security updates and administrative rights are constrained.
Why it matters: Endpoint compromise can become an identity or lateral-movement problem when local control is broad.
How to verify: Sample patch state, local administrators, endpoint protection, encryption, and device ownership.

Cloud & SaaS

Minimum expectation: Administrative roles, guest access, integrations, and recovery ownership are reviewed.
Why it matters: Persistent access accumulates as teams, vendors, and connected applications change.
How to verify: Enumerate administrators, guests, high-risk integrations, sharing settings, and stale access.

Backups

Minimum expectation: Critical systems have owned backups and a documented restoration test.
Why it matters: Backup existence does not prove that recovery will work under incident conditions.
How to verify: Confirm coverage, administrative separation, restoration ownership, and the latest representative restore test.

Logging

Minimum expectation: Security-relevant events are retained long enough to support detection and investigation.
Why it matters: An incident cannot be reconstructed from telemetry that was never collected or has already expired.
How to verify: Map high-value systems to log sources, retention, alert ownership, and evidence export procedures.

Incident readiness

Minimum expectation: Decision authority, communications, evidence, containment, and recovery roles are documented.
Why it matters: Response slows down when teams discover responsibilities during the incident itself.
How to verify: Walk through a realistic scenario and record unresolved decisions, contacts, evidence gaps, and recovery dependencies.

Vendor access

Minimum expectation: Third-party access has an owner, business reason, review date, and offboarding path.
Why it matters: Vendor access often persists after the work that justified it has ended.
How to verify: Sample vendor identities and integrations for owner, scope, last use, review date, and removal procedure.

Baseline means starting point.

Organizations with regulated data, safety-critical systems, contractual obligations, or higher threat exposure may need substantially stronger controls.