The architecture of a dual-baseline program
- The crosswalk is the pivot table. Maintained as a first-class artifact, it maps every implemented control to its Rev. 2 requirement and its Rev. 3 requirement. Every other dual-baseline mechanism hangs off this table.
- One SSP as source of truth, one derived view. The primary SSP (usually structured on Rev. 3 once you convert; see the conversion guide) generates the other view through the crosswalk. Editing the two views independently is how they drift into contradiction.
- Evidence tagged to both objective sets. Each artifact carries two indexes: its 800-171A objective and its 800-171A Rev. 3 objective. You collect once and report twice.
- ODP values resolved per customer, enforced at the strictest. Where customers' parameter values differ, either enforce the strictest value tenant-wide or segment deliberately. Record the decision in the ODP register so each customer's view shows its own value truthfully satisfied.
- Change control asks two questions. Every change to the boundary (a new tool, user population, or contract) is evaluated against both baselines before it ships, in one review that returns a verdict for each.
Reporting under two baselines
In dual-baseline operation, your SPRS score stays a Rev. 2 artifact computed under the DoD Assessment Methodology, while a civilian customer might see a Rev. 3 posture summary with agency ODP values. Both must be true at the same time, and both are representations to the federal government. One implementation, mapped honestly to each baseline, keeps that misrepresentation risk manageable in a way two optimistic narratives cannot.
When does dual-baseline end?
It ends when your last contract that incorporates Rev. 2 closes out. Your contractual baseline inventory predicts that date, and DoD rulemaking will eventually force it. If you built the dual-baseline machinery, retiring the Rev. 2 view means deleting a column. If you ran two programs, you now have a whole program to decommission.
Dual-baseline operation is a managed-compliance service.
We continuously maintain the crosswalk, index evidence to both baselines, resolve ODP values per customer, and run change control across both. Or email rj@indirectit.com directly.