What it is
A Compliance Baseline Configuration Profile is a working spreadsheet for defining your endpoint security baseline against a recognized standard, then scoring how far your fleet has drifted from it. The Baseline tab lists hardening controls, disk encryption, OS patch level, password policy, firewall, screen lock, EDR, account lockout, and more, each with a target value, a weight, and a status you mark 1 if the control is enforced fleet-wide and verified, or 0 if it is not. A weighted score, a running total, and a live Scorecard update as you fill it in, turning an abstract notion of 'are we hardened' into a single compliance percentage with a clear pass or fail verdict.
The profile is explicitly mapped to the settings you would push through a UEM or MDM configuration profile, Intune, Jamf, Workspace ONE, and audited against a standard like the CIS Benchmarks or the Microsoft and Apple security baselines. The Settings tab lets you record which standard you are measuring against (for example CIS Benchmark Level 1), the platform (Windows 11 and macOS), and the pass threshold, defaulted to 90 percent, that drives the verdict. The Scorecard tab then computes total possible weight, achieved weighted score, the compliance percentage, your headroom versus the threshold, and a plain YES or NO on whether the fleet meets your bar.
What makes this more than a static document is the weighting and live scoring. Not every control matters equally, disk encryption with an escrowed recovery key carries more weight than a minor setting, so the score reflects real risk rather than a flat checkbox count. Because the spreadsheet recalculates as you change a status from 0 to 1, it doubles as both a planning tool, showing which gaps would most improve your score, and an ongoing measurement of baseline drift you can revisit each quarter as your hardening matures and you tighten the threshold.
What it's used for
Teams use a baseline configuration profile to make endpoint hardening measurable, turning a long list of security settings into a single, defensible compliance score. It supports a focused set of jobs:
- ✓ Defining what 'compliant' means for the fleet by listing the hardening controls, encryption, patch level, password policy, firewall, screen lock, EDR, account lockout, each with an explicit target value drawn from a standard like CIS.
- ✓ Scoring current reality against the baseline by marking each control 1 (enforced and verified fleet-wide) or 0 (not), so the gap between policy and practice becomes a concrete number rather than a vague worry.
- ✓ Weighting controls by risk so the score reflects what actually matters, disk encryption with escrowed keys counts more than a minor setting, instead of treating every control as equal.
- ✓ Recording the standard and platform you are measuring against, CIS Benchmark Level 1, Windows 11 and macOS, so the baseline is anchored to a recognized reference rather than internal opinion.
- ✓ Setting a pass threshold (defaulted to 90 percent) that drives a clear YES or NO verdict on whether the fleet meets your bar, and showing your headroom or shortfall against it.
- ✓ Identifying the highest-impact remediation: because the score is weighted and live, you can see which 0-status controls would most improve compliance if you closed them next.
- ✓ Tracking baseline drift over time by re-scoring each quarter and tightening the threshold as hardening matures, turning the profile into an ongoing measurement rather than a one-off audit.
Who uses it
A scored baseline profile is the shared language between the people who set security policy, the people who enforce it, and the people who audit it. Each role uses the spreadsheet differently:
Context & good to know
The hard part of endpoint hardening is not knowing the controls, those are well documented in the CIS Benchmarks and vendor baselines, but knowing how completely they are actually enforced across a real, messy fleet. Organizations routinely have a hardening policy on paper while the live configuration tells a different story: encryption enforced on most devices but not all, EDR deployed but unhealthy on a subset, a firewall rule that drifted off. A scored baseline profile exists to close that gap between the policy and the practice, replacing 'we're mostly hardened' with a number you can defend and improve.
Weighting is what makes the score meaningful rather than cosmetic. A flat checklist treats disabling an obscure setting as equal to enforcing disk encryption with an escrowed recovery key, which badly misrepresents risk. By assigning weights, the profile lets a small number of high-value controls dominate the score the way they dominate real exposure, so a fleet that nails encryption, EDR, and patching scores well even with minor gaps, while one that misses a critical control cannot hide behind a long tail of trivial passes. The pass threshold then converts the weighted score into the binary leadership and auditors actually want: does the fleet meet the bar or not.
This profile is the measurement half of a hardening program whose action half is the hardening checklist, and it draws its live data from the same place an asset inventory does. The checklist tells you which controls to enforce; the baseline profile tells you how far you have gotten and where to push next; the asset inventory proves the coverage device by device. Because the spreadsheet is tool-agnostic, it sits cleanly above Intune, Jamf, Kandji, or any UEM, and because it recalculates live, it turns the quarterly question 'are we still hardened' from a guess into a re-scored, evidenced answer that you can watch improve as you tighten the threshold over time.