Question $1$

$5$ pts

Which statement is NOT true regarding an organization's "baseline"?

A set of defined standards that are applicable to only one section of a network.

The set of controls that are applicable to information or an information system to meet legal, regulatory, or policy requirements, as well as address protection needs for the purpose of managing risk.

The set of security and privacy controls defined for a low$-$impact, moderate$-$impact, or high$-$impact system or selected based on the privacy selection criteria that provide a starting point for the tailoring process.

Predefined sets of controls specifically assembled to address the protection needs of groups, organizations, or communities of interest.