Documentation
Everything you need to get started with Baseline Authority.
Quick Start Guide
Follow these nine steps to go from download to compliance.
Download the Local Authority Engine
Visit the Downloads page on your internet-connected workstation and download the installer.
Install on your target Windows system
Run the installer. No .NET runtime required — the engine is fully self-contained.
Download the appropriate Baseline Pack
Choose the .bapack file matching your target platform (e.g., Windows 11 23H2 Standalone STIG V2R2).
Transfer both files to your isolated environment
Copy the installer and .bapack file to approved removable media following your organization's cross-domain transfer procedures.
Launch the engine
Start the Local Authority Engine. It opens a dashboard at 127.0.0.1:1012 in your browser.
Import your .bapack file
Use the Import function in the dashboard. The engine verifies integrity and loads all rules automatically.
Review rules and toggle selections
Browse every STIG rule. Enable, disable, mark as not applicable, or defer rules to match your environment.
Run an audit
Execute a compliance scan against your enabled rules. The dashboard shows pass/fail results for every check.
Review results and remediate as needed
Review failures, then apply remediations through the dashboard. All changes are safe and reversible.
Key Concepts
What is a Baseline Pack?
A Baseline Pack (.bapack file) is a portable, integrity-verified package containing STIG rules, metadata, and version information. It is designed for secure transfer across air-gapped boundaries via removable media. Each pack targets a specific platform and STIG version.
Full Pack vs Delta Pack
A Full Pack contains every rule for a given STIG release and is used for initial setup or fresh installations. A Delta Pack contains only the rules that changed between two STIG versions — new rules, modified rules, and removed rules. When you import a delta pack, your existing tailoring decisions are automatically preserved for unchanged rules.
Rule States
Every rule in the Local Authority Engine has a state that you control:
Audit vs Remediation
An Audit scans the system and reports which enabled rules pass or fail without making any changes. A Remediation applies fixes to bring failing rules into compliance. Remediations are safe, auditable, and reversible — the engine creates restore points before making changes.
Compliance Scoring
The compliance score represents the percentage of enabled rules that pass audit. It is calculated as: passing rules / total enabled rules * 100. Rules marked as disabled, not applicable, manual, or deferred are excluded from the score.
Frequently Asked Questions
Does this require internet?
No. The Local Authority Engine is completely offline. It runs on localhost and never attempts any network connections. The only internet connection needed is on your connected workstation to download packs from this site.
Does this send data anywhere?
No. All audit and remediation data stays on the local machine. The engine has no telemetry, no phone-home behavior, and no external dependencies. Everything is stored locally in the engine's data directory.
What STIGs are supported?
Windows 11 Standalone STIG is supported initially. Windows Server and additional platforms are on the roadmap. Check the Downloads page for the latest available packs.
How do I update?
Download the latest delta pack from our site, transfer it into your isolated environment, and import it into the Local Authority Engine. Your previous tailoring selections are automatically preserved — you only need to review new or changed rules.
Can I customize which rules apply?
Yes. Every rule can be individually enabled, disabled, marked as not applicable, set to manual review, or deferred. Your selections persist across pack updates, so you only need to review changes.