Help Center/ SecMaster/ User Guide/ Risk Prevention/ Baseline Checks/ Baseline Check Overview
Updated on 2026-10-10 GMT+08:00
View PDF
Share

Baseline Check Overview

SecMaster can scan cloud services for risks in key configuration items, report scan results by category, generate alerts for incidents, and provide hardening suggestions and guidelines.

SecMaster provides some built-in compliance packs for key configuration items of Huawei Cloud services, to help detect the risky configurations of cloud services. The compliance packs include Huawei Cloud Security Configuration 3.0, General Data Protection Regulation, OS Configuration Baseline, Common Weak Password Detection, Password Complexity Policy Detection, PCI DSS, NIST SP 800-53, ISO/IEC 27002:2022, Huawei Cloud AI Security Configuration, and DJCP 2.0. In addition, you can create custom check items and compliance packs to meet your own needs.

Compliance packs Cloud Security Compliance Check 1.0, DJCP 2.0 Level 3 Requirements, and Network Security have been disabled and will be taken offline. No operations are allowed.

Table 1 SecMaster built-in compliance packs

Compliance Pack

Description

Applicable Region

Category

Domain

Cloud Security Compliance Check 1.0 (disabled and to be taken offline)

This compliance pack automates the assessment of your data security posture across four key areas: identity and access management, infrastructure security, data protection, and backup integrity. It helps you efficiently identify data security issues.

Global

Industry standards

Network security

(Network Security) (disabled and to be taken offline)

This compliance pack offers automated security checks aligned with international best practices. It enables cloud customers to identify threats and risks across key assets, including cloud servers, web applications, object storage, and data security centers, enhancing overall network security capabilities.

Global

Industry standards

Network security

Huawei Cloud Security Configuration 3.0

This compliance pack automates security configuration checks for a wide range of cloud services against established security benchmarks, helping you establish and maintain a secure cloud foundation. The covered services include identity and access management, logging and monitoring, cloud servers, containers, networking, storage, databases, enterprise intelligence, application middleware, development and operations (DevOps), CDN, intelligent edge, and security services.

Global

Industry standards

Network security

GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data privacy law established by the European Union to safeguard individuals' personal data and ensure its secure processing. It mandates that all organizations processing EU citizens' personal data must ensure transparent, lawful, and secure data processing practices.

European Union

Regional laws

Data protection

OS Configuration Baseline

This compliance pack checks password complexity policies, common weak passwords, and configurations. It can detect insecure password configurations and risky configurations in key software on servers, and provide rectification suggestions for detected risks, helping you correctly handle risky configurations on servers.

Global

Industry standards

Operating systems (OSs)

Common Weak Password Detection

This check compares passwords used by accounts with common weak passwords defined in a library and reminds users to change detected weak passwords.

Global

Industry standards

Operating systems (OSs)

Password Complexity Policy Detection

A password complexity policy specifies the rules that user passwords must comply with to improve password security and defend against brute-force attacks. This feature checks the password complexity policies in Linux and provides suggestions to help improve password security.

Global

Industry standards

Operating systems (OSs)

PCI-DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard jointly formulated by five major payment card brands (Visa, Mastercard, American Express, Discover, and JCB) to protect payment card data and prevent data leaks and frauds.

Global

Industry standards

Data security

NIST SP 800-53

NIST SP 800-53 provides a comprehensive security control framework for organizations to identify, assess, and manage information security risks.

Global

Industry standards

Data security

ISO/IEC 27002:2022

ISO/IEC 27002 is an international standard that provides guidance for organizations to establish, implement, maintain, and continually improve an information security management system (ISMS), with a focus on cybersecurity. This compliance pack provides best practices and control objectives for key cybersecurity aspects, including access control, encryption, human resource security, and incident response. This standard provides organizations with a practical blueprint to effectively protect their information assets from cyber threats.

Global

Industry standards

Network security

Huawei Cloud AI Security Configuration

This compliance pack follows the Huawei Cloud AI security configuration baseline, providing a framework for checking AI system security and compliance. It includes best practices for the security configurations of cloud services such as ModelArts and HSS.

Global

Huawei Cloud AI compliance standards

AI security

DJCP 2.0

This compliance pack provides check items and guidelines to help you evaluate your data security management. It also suggests improvements based on the level 3 requirements of China's national standard GB/T 22239-2019 information security technology — Baseline for classified protection of cybersecurity.

Global

DJCP 2.0

Network security

Notes and Constraints

  • Only SecMaster professional edition supports OS Configuration Baseline, Common Weak Password Detection, Password Complexity Policy Detection compliance packs. Before using these packs, you need to enable HSS baseline log access and Automatically converts alarms for HSS baseline logs in SecMaster. The procedure is as follows:
    1. In the navigation pane on the left of the target workspace, choose Log Audit > Cloud Service Access.
    2. Locate the HSS baseline row in the Host Security Service, click in the Automatically converts alarms column. Click Save. In the displayed dialog box, click OK. For more details, see Enabling Log Access.
  • The baseline checks of compliance packs OS Configuration Baseline, Common Weak Password Detection, and Password Complexity Policy Detection are performed in HSS instead of SecMaster. However, you can view check results in SecMaster. If you need to perform an HSS baseline check, go to the HSS console and complete the check. For details, see Performing a Baseline Check on HSS.

Baseline Check Methods

  • Automated baseline checks

    By default, SecMaster checks assets associated with the Huawei Cloud Security Configuration 3.0 compliance pack in the current region of your account every three days from 00:00 to 06:00.

    The default check plan only allows you to enable or disable automatic baseline checks.

  • Scheduled custom baseline checks

    You can configure the custom automatic check period, time, and scope, as well as automatic check items in compliance packs Huawei Cloud Security Configuration 3.0, Huawei Cloud AI Security Configuration, ISO/IEC 27002:2022, PCI DSS, and DJCP 2.0. For details about how to perform a baseline check, see Performing a Scheduled Baseline Check.

  • Immediate baseline checks

    You can start all security standards or a specific check plan to detect violations in real time.

    You can set the auto check items in the compliance packs. For check items that support only manual check, the system generates check items whose check results are To be checked. You need to perform a manual check offline and then report the check results to the SecMaster console.

    For details about immediate baseline checks, see Starting an Immediate Baseline Check.

    • You can start all compliance packs in use to detect violations against automatic check items.
    • You can start a check plan to detect violations against check items in the compliance pack configured in the check plan.
    • You can select one or more check items and start them at once.
  • Manual baseline checks

    Some check items in baseline checks are manual. After you finish a manual check, report the check results to SecMaster. The pass rate is calculated based on results from both manual and automatic checks. For automatic check items, you can manually start specific checks.

    All check items in General Data Protection Regulation and NIST SP 800-53 are manual. Some check items in Huawei Cloud Security Configuration 3.0, ISO/IEC 27002:2022, and Huawei Cloud AI Security Configuration are manual.

    For details about manual checks, see Performing a Manual Baseline Check.

Usage Process

The process of using baseline checks is as follows.

Table 2 Process

No.

Operation

Description

0

(Optional) Enabling SecMaster access to HSS baseline logs in Host Security Service.

This operation is required only when SecMaster professional edition is in use and the OS Configuration Baseline, Common Weak Password Detection, and Password Complexity Policy Detection compliance packs are enabled. For details about how to enable compliance packs, see Editing, Enabling, Disabling, or Deleting a Compliance Pack.

In the navigation pane of the target workspace, choose Log Audit > Cloud Service Access. On the displayed page, click next to HSS baseline and the button in the Automatically converts alarms column, and click Save. In the dialog box displayed, click OK. For details, see Enabling Log Access.

NOTE:

For the Common Weak Password Detection and Password Complexity Policy Detection compliance packs, if HSS protection is disabled, ECSs with weak passwords are not displayed on the HSS console, but are still displayed on the SecMaster console.

1

Conducting a Scheduled Baseline Check

SecMaster uses the default check plan to check all assets.

  • By default, SecMaster checks assets associated with the Huawei Cloud Security Configuration 3.0 compliance pack in the current region of your account every three days from 00:00 to 06:00.
  • Custom plans: SecMaster performs baseline checks based on the compliance packs and time you specify in the custom check plans.

2

Starting an Immediate Baseline Check

The baseline checks module supports periodic and immediate checks.

  • Periodic check: The system automatically executes the default check plan or the check plans you configure.
  • Immediate check: You can add or modify a custom check plan and start the check plan immediately. In this way, you can check whether the servers have certain unsafe configurations in real time.

3

Viewing Baseline Check Results

You can view the baseline check results after each manual or automated check. You can quickly learn affected assets and details about the baseline check items.

4

Handling Baseline Check Results

You can handle risky items based on the rectification suggestions.
Parent topic: Baseline Checks