<p>As noted in the comments there are several applications for the term.  This answer focuses on the term as it relates to a compliance audit.</p>
<p>In the context of an audit, a <code>golden image</code> refers to an original image that is used when creating servers in your environment.  Based on the reference below:</p>
<blockquote>
<p>The term itself comes from the old practice of recordable CDs being manufactured with gold film. Hence the gold colored CD actually being the source</p>
</blockquote>
<p>The NIST Risk Management Framework (800-53) refer to <code>golden images</code> as <code>baseline configurations</code>.  In 800-53 CM-2:</p>
<blockquote>
<p>Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.</p>
</blockquote>
<p>An example that an auditor would be looking for is a hardened image of a specific OS version that is used to build out other servers in your environment. It demonstrates that your base-build a) has been reviewed, b) has not been altered, and that c) its use is repeatable.</p>
<p><strong>References</strong></p>
<p><a href="https://softwareengineering.stackexchange.com/questions/62472/what-is-the-genesis-of-the-golden-master-term">What is the Genesis of the Term Golden Master</a><br />
<a href="https://www.techopedia.com/definition/29456/golden-image" rel="nofollow noreferrer">Golden Image</a><br />
<a href="https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/control?version=5.1&amp;number=CM-2" rel="nofollow noreferrer">NIST 800-53 CM-2</a></p>

CC BY-SA 4.0
2022-03-04T13:51:31.180Z
2022-03-04T13:51:31.180Z
kenlukas
<p>Is there a defacto understanding of what a golden image is?  I've had it come up in requirements to satisfy cloud audits. What's the meaning of &quot;Golden&quot; when it comes to audit and compliance, especially for cloud services?</p>
<p>It seems like the word &quot;Golden&quot; has different meanings when it comes to different platforms, for instance you can mark a &quot;Golden Snapshot&quot; in UCS Director.</p>

CC BY-SA 4.0
2022-03-01T08:16:18.450Z
Intriguing question, since it may end up having something like a canonical answer, but after a quick google search, it's difficult to find a single definition. Do you think perhaps you could rephrase the question to make it clearer that you are concerned about _compliance_?
Bruce Becker
CC BY-SA 4.0
2022-03-03T15:00:17.230Z
@BruceBecker yeah, this was something that came up in an AWS Managed Services Provider audit.  One of their criteria is maintaining golden images, but it just sounds like a buzz word.
Peter Turner
<terminology><virtualization><images>
What is a golden image?
Peter Turner
# What is a golden image?

(Asked by: username_0 on 2022-02-28)

Is there a defacto understanding of what a golden image is? I've had it come up in requirements to satisfy cloud audits. What's the meaning of "Golden" when it comes to audit and compliance, especially for cloud services?

It seems like the word "Golden" has different meanings when it comes to different platforms, for instance you can mark a "Golden Snapshot" in UCS Director.

**Tags:** terminology, virtualization, images

> **Comments:**
> **username_1**: Intriguing question, since it may end up having something like a canonical answer, but after a quick google search, it's difficult to find a single definition. Do you think perhaps you could rephrase the question to make it clearer that you are concerned about _compliance_?  
> **username_0**: @BruceBecker yeah, this was something that came up in an AWS Managed Services Provider audit.  One of their criteria is maintaining golden images, but it just sounds like a buzz word.  

---

## 1 answers

### Answer by username_2 on 2022-03-04. Score: 3

As noted in the comments there are several applications for the term. This answer focuses on the term as it relates to a compliance audit.

In the context of an audit, a `golden image` refers to an original image that is used when creating servers in your environment. Based on the reference below:

> The term itself comes from the old practice of recordable CDs being manufactured with gold film. Hence the gold colored CD actually being the source

The NIST Risk Management Framework (800-53) refer to `golden images` as `baseline configurations`. In 800-53 CM-2:

> Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.

An example that an auditor would be looking for is a hardened image of a specific OS version that is used to build out other servers in your environment. It demonstrates that your base-build a) has been reviewed, b) has not been altered, and that c) its use is repeatable.

**References**

[What is the Genesis of the Term Golden Master](https://softwareengineering.stackexchange.com/questions/62472/what-is-the-genesis-of-the-golden-master-term)  
[Golden Image](https://www.techopedia.com/definition/29456/golden-image)  
[NIST 800-53 CM-2](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/control?version=5.1&number=CM-2)


---

