## 2 Overview of the Security Baseline  
The SB emphasizes the organizational capability of the NREN, arranges requirements by maturity level, and provides references to the ISO/IEC 27001 standard for easier integration [10]. The SB consists of four areas, which were found to be essential for the security level of each organization. These areas are very similar to the recently published revision of ISO/IEC 27001 [11]. The four areas are split into 15 modules; each module contains three maturity levels, and each level contains three requirements. A security area consists of two parts: a specific domain that covers one particular security subject and security requirements split into three maturity levels. Each maturity level contains the same number of requirements, i.e. three for level one, two for level two, and two for level three. An organization that wants to achieve a higher maturity level needs to comply with all requirements from this and the lower levels. In order to illustrate this, a taxonomy was created for each of these areas that shows the connection between a domain and its requirements per maturity level. Figure 1 displays the Policy, the foremost security area in the SB, encompassing four domains. This section addresses leadership and the coordination of IS, divided into four modules. Engaging top management to enforce essential regulations is pivotal for the successful implementation of ISM. These regulations should be articulated as policies, clearly defining expected conduct and forbidden actions. From the top-level IS policy, more specific policies should be formulated to oversee the management of information and technologies. In the end, it is imperative for an organization to establish and adhere to not only its policies but also to external regulations. The section Management Commitment and Mandate outlines requirements to ensure organizational leaders support the ISM strategy. This is deemed the most crucial step in initiating and maintaining a successful security program. As a result, an organization must appoint a designated security official, establish a top-tier policy, and allocate a budget to uphold it. Subsequently, the active involvement of top management in communication, reporting, and decision-making is essential to continuously enhance security efforts. The Internal Security Policy comprises multiple policies delineating both organizational and technical security measures. Each organization must meticulously consider the behaviors they wish to permit and the directives they aim to establish. These directives pertain to services, systems, or any devices and influence how they are utilized in daily operations. It is vital to not only articulate and document these policies but also to vigilantly monitor and enforce them. An organization must extract an Acceptable Use Policy from its main security policy. This policy sets rules for the organization's information systems, guiding users on their appropriate use. The content should encompass areas such as the use of networks, hardware, emails, and general information. No individual should be permitted to use any system within the organization without first being familiar with and agreeing to the acceptable use policy. The Regulatory and Privacy elements are paramount for all organizations to consider. Within the EU, the General Data Protection Regulation (GDPR) primarily addresses these aspects. Regardless of this particular regulation, it is in the interest of every organization to ensure a foundational level of data protection. This necessitates designating a responsible individual for data protection and privacy, who will then enact measures to secure personal data and facilitate communication with users and regulatory bodies. This domain is tripartite in nature. To foster and adhere to secure processes that preclude IS incidents, both staff and external entities must be adequately informed and trained. Equally crucial is ensuring security protocols are referenced during hiring, with new hires receiving proper orientation.