Tailor a baseline into a profile

Objectives

The platform lead hands you a branch where the vendored 800-53 Rev 5 catalog has been edited directly: three control statements rewritten, one parameter value changed inside the catalog file. He describes this as "our tailored baseline".

Rebuild the decision as a profile instead. Reference the source catalog rather than replacing it, adopt the impact baseline the production tenant sits at, select exactly the controls the scope note lists, set the tightened parameter at the profile layer, record why, and state explicitly that the catalog is not edited in place.

source catalog: nist-800-53-rev5 (vendored, currently edited in place)
production tenant impact level: moderate

scope note: controls in scope for this profile:
  AC-2  account management
  IA-2  identification and authentication
  AU-6  audit record review

internal access standard: inactive accounts disabled after 15 days
  (the catalog default for this parameter is 30 days)

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Separate the requirement from the decision

   The lead has merged two things under the word "tailored": the requirements published by someone else, and the choices your organisation made about them. Only the second is yours to write.

   Everything you author here is a decision record. If a line could not be defended to an assessor as a choice, it does not belong in the profile.

   References the source catalog instead of replacing itCatalog is declared not edited in place

2. Step 2

   Point at the catalog, do not carry it

   The first field should identify the external catalog by its published identifier, exactly as the fixture names it, so the profile resolves against the upstream document rather than a local copy.

   Then make the non-editing commitment explicit as a boolean rather than a comment: a machine can check a field, and nobody reads comments in review.

   References the source catalog instead of replacing itCatalog is declared not edited in place

3. Step 3

   Adopt the baseline the fixture states

   The impact level is given to you. Use the single lowercase word the scope note uses for the production tenant; do not upgrade it because it feels safer, since an unjustified upgrade is as much an undocumented decision as an unjustified removal.

   Adopts the impact baseline the tenant sits at

4. Step 4

   Select exactly what is in scope

   The scope note lists three control identifiers. Include those and only those, in their published uppercase form. Adding a fourth because it seemed related is a tailoring decision with no rationale behind it.

   Selects exactly the in-scope controls

5. Step 5

   Set the parameter where it belongs, and say why

   The internal standard is stricter than the catalog default. Express that as one entry naming the control it applies to, a stable parameter key of your own choosing, and the numeric value from the fixture.

   Then write a rationale sentence that names the driver: a standard, a contract, an inherited platform control. A rationale that says nothing beyond "per discussion" is the failure mode this whole exercise exists to prevent.

   Tightened parameter set at the profile layerTailoring decision carries a recorded rationale

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.