the baseline approach, basically, what you're going to do is set a minimum set of controls to protect the assets and then, compare what you have with those controls, and try to identify the gaps, or overlaps, and then fix them.