Solutions
Start with a strong foundation
Define security baselines once. Enforce them everywhere. Know when they drift.
Core concept
Requirements meet organizational scope.
A baseline connects what you must comply with to where you must comply with it. vucavoid matches requirements to your assets, processes, and entities automatically, based on criteria you define once.
- Automatic matching
- Define criteria once. Matches generate across your entire scope as requirements and assets change.
- Scope groups
- Group assets, processes, and entities by business function, location, or any other dimension.
- Manual overrides
- Override any automatic match with documented rationale. Full audit trail on every decision.
Baselines that hold
Baseline templates
Start from proven templates for ISO 27001, BSI IT-Grundschutz, or your own standards.
Drift detection
Know immediately when an asset, process, or control deviates from its assigned baseline.
Coverage mapping
See which assets and processes are covered by baselines and where gaps remain.
Versioned baselines
Track how baselines evolve over time. Compare versions and understand what changed.
Enforcement workflows
Assign remediation tasks automatically when drift is detected. Track resolution.
Audit evidence
Generate baseline compliance reports for auditors with a single click.
Continuous monitoring
Know the moment a baseline drifts.
Baselines go stale when requirements change, assets move, or controls weaken. vucavoid detects 8 types of drift automatically and creates targeted tasks to resolve them.
- 8 trigger types
- From requirement deactivation and scope removal to criteria mismatch and object type changes.
- Severity classification
- High and medium severity levels. Prioritize response based on the type of drift detected.
- Automatic task creation
- Contextual tasks with descriptions, priorities, and deadlines. Generated the moment drift is detected.
- Evidence freshness
- Current, aging, stale, or missing. Evidence freshness tracked per match, per control.
- Fulfillment tracking
- Four states: fulfilled, partially fulfilled, unfulfilled, under review. Calculated from control effectiveness.
- Exception management
- Document accepted deviations with rationale and expiry. Full audit trail on every exception.
Baselines are not checklists. They are living contracts between what you promised and what you actually enforce.
How it works
Define your baselines
Start from a template or build your own. Define the minimum security requirements for each scope.
Apply to your assets
Assign baselines to assets, processes, or organizational units. Track coverage in real time.
Monitor and enforce
Detect drift automatically. Generate remediation tasks and keep baselines enforced.