PL-10 Baseline Selection

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	None

Related controls: PL-2, PL-11, RA-2, RA-3, SA-8

Control statement

Select a control baseline for the system.

NIST discussion

Control baselines are predefined sets of controls specifically assembled to address the protection needs of a group, organization, or community of interest. Controls are chosen for baselines to either satisfy mandates imposed by laws, executive orders, directives, regulations, policies, standards, and guidelines or address threats common to all users of the baseline under the assumptions specific to the baseline. Baselines represent a starting point for the protection of individuals’ privacy, information, and information systems with subsequent tailoring actions to manage risk in accordance with mission, business, or other constraints (see PL-11 ). Federal control baselines are provided in SP 800-53B . The selection of a control baseline is determined by the needs of stakeholders. Stakeholder needs consider mission and business requirements as well as mandates imposed by applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. For example, the control baselines in SP 800-53B are based on the requirements from FISMA and PRIVACT . The requirements, along with the NIST standards and guidelines implementing the legislation, direct organizations to select one of the control baselines after the reviewing the information types and the information that is processed, stored, and transmitted on the system; analyzing the potential adverse impact of the loss or compromise of the information or system on the organization’s operations and assets, individuals, other organizations, or the Nation; and considering the results from system and organizational risk assessments. CNSSI 1253 provides guidance on control baselines for national security systems.

Assessment objectives (SP 800-53A)

Objectives and methods for PL-10

Determine if a control baseline for the system is selected.

Examine: Security and privacy planning policy; procedures addressing system security and privacy plan development and implementation; procedures addressing system security and privacy plan reviews and updates; system design documentation; system architecture and configuration documentation; system categorization decision; information types stored, transmitted, and processed by the system; system element/component information; stakeholder needs analysis; list of security and privacy requirements allocated to the system, system elements, and environment of operation; list of contractual requirements allocated to external providers of the system or system element; business impact analysis or criticality analysis; risk assessments; risk management strategy; organizational security and privacy policy; federal or organization-approved or mandated baselines or overlays; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with security and privacy planning and plan implementation responsibilities; organizational personnel with information security and privacy responsibilities; organizational personnel with responsibility for organizational risk management activities.

Policy statement

• Each System owner shall select a control baseline for the system, based on its security categorization, and record the selection in the system security plan. (PL-10)
• A system that processes personally identifiable information shall also apply the privacy control baseline. (PL-10)

Federal systems

Federal systems select the SP 800-53B security baseline that matches the system’s impact level: the highest impact level for confidentiality, integrity and availability under FIPS 199, as FIPS 200 specifies.

• The System owner shall select the baseline that matches the system’s FIPS 199 impact level. (PL-10)

From the Planning Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PL-10 asks you to select a control baseline for the system. NIST’s PL-10 discussion calls a baseline a starting point that you then tailor (PL-11), chosen from the system’s information types, the potential impact of their loss and the risk assessment results.

Common implementations. Select the baseline that matches the approved security categorization (RA-2). SP 800-53B section 2.2 defines the levels by the “high water mark”:

• A low-impact system has all three security objectives at low.
• A moderate-impact system has at least one objective at moderate and none at high.
• A high-impact system has at least one objective at high.

The baseline is the Low, Moderate or High security baseline in its Chapter Three. A system that processes personally identifiable information also applies the Privacy baseline, which SP 800-53B applies irrespective of impact level. Record the baseline, and any overlay or organization-tailored baseline applied on top of it, in section 10 of the system security plan (PL-2a.11).

SP 800-37 Rev. 2 task S-1 also allows an organization-generated selection, with no predefined baseline, for highly specialized systems such as a medical device. Most systems use a baseline. Organizations often publish their own tailored baselines (task P-4) so systems start from one approved set. Every control page in this guide shows which baselines include it, and the Moderate baseline page lists them all.

Organization-defined parameters. PL-10 has none. In the Planning policy, the system owner selects the baseline from the security categorization and records it in the security plan, and a system that processes personally identifiable information also applies the Privacy baseline. The decision worksheet’s typical answer on overlays is none by default, with an overlay where a sector, regulator or customer requires one; the authorizing official decides.

Evidence assessors ask for.

• The security plan section naming the baseline and any overlays
• The approved categorization, matching the baseline
• For a system that processes personally identifiable information, the Privacy baseline controls in the plan
• The control set in the governance, risk and compliance tool, matching the selected baseline and the catalog release in use

Inheritance. The organization may provide tailored baselines and overlays as common resources. The selection itself is system-specific.

Common findings.

• A baseline that does not match the categorization, for example the Low baseline for a system categorized moderate.
• The Privacy baseline left out for a system that processes personally identifiable information.
• A control set still built from an older catalog revision.
• An overlay a sector or customer requires not applied, or applied with no record in the plan.

Enhancements in the Moderate baseline. PL-10 has no enhancements.

Federal systems (as of October 2026). FIPS 200 (March 2006) sets the high-water mark rule and the minimum security requirements, and OMB Circular A-130, Appendix I, section 5.a, says FIPS are mandatory. Section 5.d says agencies’ security controls “must include one of the three security control baselines” that matches the system’s impact level. SP 800-53B’s current release is 5.2.0 (August 27, 2025), which made no changes to the baselines. Its footnote 17 cautions that applying the Privacy baseline does not by itself meet every OMB A-130 privacy obligation. For national security systems, NIST’s PL-10 discussion points to CNSSI 1253.

Artifacts

• Planning Decision Worksheet
• Planning Policy