A
baseline configuration is the documented, approved, hardened configuration for a system type — the secure starting point all instances should match.
Deviation from baseline = configuration drift = security risk. Automated tools (Ansible, Puppet) enforce baselines. SCAP (Security Content Automation Protocol) automates baseline compliance checking.