## 2 Overview of the Security Baseline
These plans should be continuously improved and tested, preferably together with other organizations, in order to test emergency communications. It is necessary to have access to senior personnel at all times who are able to take control in the event of a disaster. Finally, the fourth area, Operations, deals with the operation of the organization, in particular, the technology required for it. Figure 4 shows its five security domains. Basically, the organization must be able to adequately secure its own infrastructure. A wide variety of cryptographic measures can help to protect data at rest and in transit. It is also important to configure access to all systems in such a way that unauthorized access is prevented. These and other security measures are only effective if the software used is always up to date and patches are applied promptly. In turn, it is essential that the organization has established a procedure for identifying and quickly removing new vulnerabilities. All software Tools used within operations need to be secured and managed by the organization. This requires an overview of all available software of company devices and an approval flow. Common security measures, such as antivirus software, firewalls, virtual private networks, network segregation, intrusion detection, and denial of service protection, should be implemented as the security program matures. It is important to have a policy on Cryptography within the organization that handles encryption of sensitive data. This policy must define the kind of data that should be protected and the cryptographic means to do that. The functions and algorithms used need to be improved, and, in the long term, only those recommended by international standards should be used. Figure 3: Taxonomy of Security Baseline requirements for threats area. Access management covers how users access information systems and data. The organization needs a procedure to assign access to users and needs to protect these user accounts using suitable authentication. Common principles, such as need-to-know and least privilege, should be considered. The goal is that at some point all accounts are tied to one person (identity assurance) and are protected by multi-factor authentication. Patch management is a proactive process to keep all software in the organization up to date. The person responsible must ensure that the defined process will identify unpatched software in the organization and update it regularly. More mature organizations aim for very short time frames until a security patch is applied to a system. A patch management system and a connection to risk management practices can help to improve the process. A well-designed vulnerability management ensures that vulnerabilities in software products are fixed before they are exploited. In parallel with proactive patch management, the organization needs to regularly check their (self-developed) software for vulnerabilities. Figure 4: Taxonomy of Security Baseline requirements for operations area. Security experts should assess new vulnerabilities and report them to the person responsible for a system, who fixes them as fast as possible. Scanning tools can help to support or automate the identification of vulnerabilities.