01 Choose and create baseline policies

[ Applies to ] StorageGuard 9.x and later  /  All supported storage, backup, SAN and cloud systems  /  Windows and Linux deployments

A baseline policy defines what StorageGuard checks your systems against. In the StorageGuard UI, baseline policies are called security policies. Every risk analysis runs the checks in your enabled policies, on the systems each policy covers, so your choice of policies decides what compliant means for your organization.

Overview

StorageGuard comes with predefined baseline policies of three main kinds:

• Vendor hardening guidelines: a vendor's security best practices for its platform.
• Industry standards and regulations, such as CIS Controls, NIST, PCI DSS, DORA and NIS2.
• Core6 baseline levels: five incremental baselines, from Essentials to Fortified, that let you harden your environment one step at a time.

You can also create your own, typically one baseline for each platform you run.

You can enable and create as many policies as you need. Each one applies to your whole environment or to a subset of it: certain system types, sites, CI groups or specific systems. So you can, for example, track Core6 Essentials everywhere and PCI DSS only at your payment sites.

How a policy decides what's checked

A policy defines its checks in one or more of three ways: by security labels, by check types, or by listing individual checks. Some predefined policies use labels, others use check types or checks. 

A check type is one requirement, such as an idle session timeout, implemented as a separate check for each supported platform; selecting it includes every implementation, for Hitachi VSP, Dell PowerScale and every other platform that has one.

A label-based policy includes every principle tagged with one of its labels, and every check that validates those principles. For example, CIS Controls includes the label CIS Control v8 4.3, which tags the principle Idle Session Termination, which the check SG-C0209T061V01: Idle session timeout validates on Dell PowerProtect DD. One principle often carries labels from several standards, so the same check can count toward more than one policy.

Two tabs define every policy:

• Analysis scope decides which checks it runs. 

• System scope decides which systems they run on. A check runs on a system only if both allow it.

Review and enable a predefined policy

By default, five predefined policies are enabled: Default, CIS Controls, ISO/IEC, NIST and PCI DSS. All others are off until you enable them; see Predefined policies for examples. To review a policy, or to turn one on:

1. Go to Baseline Configuration > Settings > Policies.
2. Double-click the policy. The Analysis scope tab shows the labels and checks it includes.
3. On the System scope tab, check which systems it covers. By default, a policy covers all system types in all sites. Narrow it if the policy should apply to only part of your environment, as described below.
4. Click Apply.
5. If the policy isn't enabled yet, right-click it and select Enable.

Changes take effect the next time a risk analysis runs. To see results straight away, run one now.

Set the system scope

By default, a policy's system scope covers all system types in all sites. To narrow it, use either or both of these. Scope rules assign systems automatically, so systems added later are included if they match. Additional items assign them directly.

1. Under Scope rules (automatically assigned), select Fetch only systems in scan scope to limit the policy to systems StorageGuard is set to scan.
2. Click Add config item to add a rule. In System types and Sites, choose what the rule covers; both start at All. Optionally, add a RegExp to narrow it further. Add more rules as needed.
3. Under Additional items (directly assigned), add Sites, Configuration items or CI groups that should always be in scope. The number next to each shows how many are assigned.
4. Click Apply.

For example, to follow CIS Controls on Dell PowerProtect DD systems only, enable CIS Controls and set its scope rule's System types to Data Domain.

Predefined policies

Policies marked Enabled are on out of the box. Turn others on as described in Review and enable a predefined policy.

Core6 baseline levels

Each level raises the bar on the one before it, so you can start with foundational controls, fix what they find, and move up, instead of facing every finding at once.

Level	Name	What it covers
1	Essentials	Foundational controls: disabling Telnet and other insecure protocols, enforcing password policies, MFA and RBAC, and preventing default Fibre Channel zoning.
2	Enhanced	Adds IP access control lists, remote support controls, email alerting, NTP time synchronization, and encryption at rest where supported.
3	Advanced	Adds certificate validation, SNMPv3, syslog integration, strong cipher suites, dual authorization for destructive operations, and encrypted backup traffic.
4	Robust	Adds resilience-oriented controls such as no root login, internal firewall enforcement, SMB signing, and NFSv4 security settings.
5	Fortified	The highest maturity level, intended for highly sensitive or regulated environments.

To work up the levels:

1. Enable Essentials and run a risk analysis.
2. Fix or tune its findings until the level's score is where you want it.
3. Enable the next level, run the analysis again, and repeat.

Standards, regulations and vendor guidelines

These are examples of the built-in policies, not the full list. To see every policy available in your installation, go to Baseline Configuration > Settings > Policies.

Policy	Based on	Out of the box
Default	StorageGuard's general security baseline.	Enabled
CIS Controls	Center for Internet Security (CIS) Critical Security Controls.	Enabled
ISO/IEC	ISO/IEC 27001 and 27002 information security controls.	Enabled
NIST	NIST guidance, including SP 800-53 security controls and SP 800-209 storage security.	Enabled
PCI DSS	Payment Card Industry Data Security Standard.	Enabled
CISA #StopRansomware	CISA's #StopRansomware guidance for ransomware prevention and recovery.	Off
CSA Cloud Controls	Cloud Security Alliance Cloud Controls Matrix (CCM).	Off
Dell PowerStore: Best Practice Guidelines	Dell's security best practices for PowerStore.	Off
DORA	EU Digital Operational Resilience Act, for financial entities.	Off
FFIEC	US Federal Financial Institutions Examination Council guidance.	Off
HIPAA	US HIPAA Security Rule for protected health information.	Off
NERC CIP	North American Electric Reliability Corporation Critical Infrastructure Protection standards.	Off
NIS2	EU Network and Information Security Directive 2.	Off
Singapore MAS TRM	Monetary Authority of Singapore Technology Risk Management guidelines.	Off
UK Cyber Essentials	UK government-backed Cyber Essentials scheme.	Off
UK NCSC CAF	UK National Cyber Security Centre Cyber Assessment Framework.	Off

Create your own baseline policy

Most organizations create one policy per platform, such as My Baseline for Hitachi VSP or My Baseline for Dell PowerScale. Each is built from existing check types and checks, and sometimes from the organization's own custom checks too.

Goal	How to build it
Build a baseline for one platform (most common)	Under Analysis scope, select check types or checks, and optionally your custom checks. Set System scope to that platform's system type.
Apply a standard to part of your environment	Include the standard's labels in Analysis scope, and limit System scope to the sites or system types it applies to.
Combine several standards into one baseline	Include labels from each standard in Analysis scope.
Leave out checks that don't apply	Use Exclude labels, Exclude checks or Exclude check types.

General

1. Go to Baseline Configuration > Settings > Policies and click +.
2. On the General tab, enter a Name and, optionally, a Description that says what the policy is for.

Analysis scope: which checks

Use any combination of the three methods. Each has an include list and an exclude list.

3. Under By labels, start typing a security label name and select it. Regular expressions are supported, so one entry can match a family of labels. The labels the policy will include appear in the Labels field. In Exclude labels, add labels to remove from that list.
4. Under By checks, add individual checks in Included checks, and remove checks in Exclude checks.
5. Under By check types, add check types in Included check types, and remove them in Exclude check types. Each check type brings in its checks for every supported platform, so you don't need to pick the Hitachi VSP, Dell PowerScale and other versions one by one.

System scope: which systems

6. On the System scope tab, set scope rules and additional items as described in Set the system scope.
7. Click Apply.

Example: a baseline for Hitachi VSP

Setting	Value
Name	My Baseline for Hitachi VSP
Included check types	The requirements you enforce on every VSP, such as idle session timeout and secure LDAP
Included checks	Any additional Hitachi VSP checks you require, plus your own custom checks for VSP, if you have any
Scope rule	System types: Hitachi VSP; Sites: All

Check types include an implementation for every supported platform, but the system scope limits this policy to Hitachi VSP systems, so only the VSP checks run. Repeat for each platform you want a baseline for.

Manage policies

Go to Baseline Configuration > Settings > Policies and right-click a policy. These actions work on predefined and your own policies alike:

Action	What it does
Enable / Disable	Turns the policy on or off. The change takes effect the next time a risk analysis runs.
Edit	Opens the policy to change its name, analysis scope or system scope. You can also double-click it. Click Apply to save.
Version history	Lists every saved version of the policy, with who saved it, when, and its version ID. Right-click a version and select View details to see it, or Revert changes to go back to it.
Export / Import	Saves a policy to a file, or loads one, for example to copy your baseline to another StorageGuard server.
Delete	Removes the policy. Deleting predefined policies isn't recommended.

See how you score

• Baseline Configuration > Overview shows Score by Policy: a grade for each enabled policy, based on the share of its checks that passed in the last analysis. A is above 90, B is 80 to 90, C is 70 to 80, D is 50 to 70, and F is below 50.
• The Compliance tab lists every check with the number of systems that passed and failed. Filter by policy or system type in the sidebar, and double-click a check to see each system's result and evidence.

Related articles

• Run a risk analysis and review the results
• Tune risk detection
• Create custom checks