Systems must be checked against MSU baseline security posture that includes a minimum set of security controls. Additional controls may be required to mitigate risks associated with specific applications or confidential data.