Which of the SP 800-65 CPIC steps involves establishing baseline prioritization?

• A. Identify the baseline
• B. Align IT investments with budget cycles
• C. Create a risk assessment
• D. Deploy a security incident response plan

Answer: (A)

In CPIC, you need a solid starting point before deciding what to invest in. Establishing a baseline provides that reference point—the current state of assets, costs, risks, and security controls. Once you know where you stand, you can prioritize investments that will reduce the highest risks or deliver the greatest return relative to that baseline. Identifying the baseline is the step that creates this baseline against which all future investments and prioritizations are measured. The other options focus on budgeting, risk assessment, or incident response, which are important activities but don’t establish the baseline used to prioritize investments.