## 1 Introduction
As a result of this initiative, the Security Baseline (SB) for NRENs [7] and the S7 Business Continuity Framework [8] were created. Both are security frameworks that are specifically tailored to the needs of NRENs and other R&E organizations. They are designed to ensure the community's compliance with current security standards and regulations. The SB is a security maturity model to measure and improve the security level of an organization focusing on organizational controls. The S7 framework expands on this and provides practical guidelines to implement a security program and comply with many of the SB requirements. The original goal of the SB was to define a common Security Baseline for the R&E community. However, it soon became apparent that the organizations in question were too heterogeneous. The GEANT community alone comprises 39 organizations in 44 countries, and each NREN serves many universities and research institutions. Defining a baseline applicable to all of these organizations thus proved to be a major challenge. Furthermore, there exists no governance authority between these organizations, i.e. there is no way to enforce compliance with certain policies. Thus, all policies would have to be made appropriately attractive so that participants would voluntarily choose to comply. If a baseline were to be established under these conditions, there are two possibilities: defininghigh- or low-security requirements. High requirements would force a high level of security, but to comply with them would be too difficult for many organizations. The expected adoption rate would be very low. Low requirements would mean that a majority of organizations could meet them, which would result in a very high adoption rate. However, there would then be no need for action for many organizations, and the baseline would not positively influence the security level of the community. It was decided to solve this problem by creating several levels of requirements and combining them to create a maturity model. This makes it possible to define different levels for different user groups or use cases. While organizations with weak ISM can still try to reach the baseline level, very mature organizations still have a way to improve their security level. This is already a great advantage compared to common security standards, which usually only allow a binary distinction between compliant and non-compliant. Furthermore, different levels enable organizations to compare their performances with each other. It is anticipated that the emerging peer pressure will trigger some competition, which will lead to a long-term increase in security maturity in the community. Although other security frameworks already offer security maturity models, they are usually lacking in the proper characteristics. For example, the NIST Cyber Security Framework (CSF) provides a multi-TIER model, but it is explicitly not a maturity model and only considers risk management. The Capability Maturity Model Integration (CMMI) is a very commonly used industry model, but it is mainly used to evaluate processes and not the maturity of security controls. Other maturity models, such as the Cybersecurity Capability Maturity Model (C2M2) [9], are comprehensive but very complex in their design and just contain the general requirements for all sectors. This is why it was decided to create a new maturity model with the SB tailored to the needs of the R&E community. Ultimately, a maturity model also provides the ability to match different requirements and maturity levels to other standards and regulations. However, this requires a very formal evaluation and mapping of the various documents. An approach to this is described in this article. The main aim of this work is to establish a universal security foundation tailored for the R&E community by introducing Security Baseline requirements.