Tailoring a Baseline

Tailoring lets you customize a baseline to fit your organization’s specific needs. You can include or exclude rules and set organization-defined values like password length or screen lock timeout.

Tip

Tailoring is optional. If the default baseline meets your needs, you can skip this step and generate outputs directly.

---

When to Tailor

Consider tailoring when you need to:

• Exclude rules that don’t apply to your environment
• Set custom values for settings like password requirements or timeout periods
• Document exceptions for rules your organization can’t implement
• Create a named baseline specific to your organization

---

Tailor a Baseline

1. Run the tailoring command

   ./scripts/generate_baseline.py -k BASELINE_NAME -t

   Example:

   ./scripts/generate_baseline.py -k 800-53r5_moderate -t

2. Enter baseline information

   You’ll be prompted for:

   • Baseline name
   • Author name
   • Organization

3. Select rules to include

   For each rule, choose whether to include it:

   Include "audit_acls_files_configure"? [Y/n/all/?]:

   Option	Action
   Y	Include this rule (default)
   n	Exclude this rule
   all	Include all remaining rules
   ?	Show rule details

   Note

   Some rules marked as “inherent” are automatically included without prompting.

4. Set organization-defined values

   For rules that need custom values, enter your setting or press Enter for the default:

   Enter value for "pwpolicy_account_lockout_enforce"
   or press Enter for recommended (3):

5. Find your files

   Your tailored baseline and custom values are saved:

   • Directorymacos_security/

     • Directorybuild/

       • Directorybaselines/

         • YOUR_BASELINE.yaml - Tailored baseline
     • Directorycustom/

       • Directoryrules/

         • *.yaml - Custom ODV values

---

Custom ODV Files

When you set a custom value, a YAML file is created in custom/rules/:

---
odv:
  custom: 5

This file overrides the default value for that rule. Your custom values are preserved and reused when you regenerate the baseline.

---

Example Workflow

# Generate a tailored NIST 800-53 Moderate baseline
./scripts/generate_baseline.py -k 800-53r5_moderate -t

# Generate outputs from your tailored baseline
./scripts/generate_guidance.py -s -p build/baselines/my_org_baseline.yaml

---

Next Steps

• How to Generate Guidance - Create outputs from your tailored baseline
• Baseline File Layout - Understand the YAML structure
• Customize Rules - Advanced rule customization