Which statement is NOT true regarding an organization's "baseline"?

Group of answer choices

The set of security and privacy controls defined for a low$-$impact, moderate$-$impact, or high$-$impact system or selected based on the privacy selection criteria that provide a starting point for the tailoring process.

The set of controls that are applicable to information or an information system to meet legal, regulatory, or policy requirements, as well as address protection needs for the purpose of managing risk.

A set of defined standards that are applicable to only one section of a network.

Predefined sets of controls specifically assembled to address the protection needs of groups, organizations, or communities of interest.