The parallel-process problem
Organizations answer to more than one set of requirements: regulations, contracts, their own policy. The usual response is a separate assessment for each, with the same controls documented again every time.
A baseline is a set of objectives
In FCR a baseline is the set of control objectives required for a particular purpose. A regulation is one baseline. The organization's own policy is another, and so is its minimum security standard.
Because a resource's control inventory is recorded in the same terms, it can be compared with any of them. Nothing has to be documented twice.
Compliance Checkups
A Compliance Checkup compares a resource's inventory with a selected baseline. It shows which requirements are met and which are not, without any manual mapping, and it can be run whenever the team wants to know where it stands.
A safe way to work toward compliance
A checkup is something a team runs for itself. The result is a list of what remains, and the team sees it first. It can be repeated as often as the team likes while it closes the gaps.
That is different from an audit, where the first view of a gap belongs to someone else.
It is also a checkup and not a compliance report. The result is a working view of where the resource stands, and it does not represent a formal attestation.
When several baselines apply
A resource is often subject to more than one baseline. Its scope is then the union of all the objectives they require, and its coverage is measured against that combined scope.
A new requirement becomes a new baseline. The inventory stays the same, and the checkup shows what the new requirement adds.
Build From Where You Are describes how to create the first baseline from policy the organization already has.