in SCCM we have ‘get’ behavior for DCM baselines. So, we can tell what machines are (or are not) compliant for a baseline and then use a query-based collection to find computers that are compliant (or not) and take action on them. As an FYI SCCM V.Next will include ‘set’ behavior so we’ll have the ability to auto-remedate non-compliant machines.
One little-discussed feature in R3 is that we can select a baseline in the console and have that query-based collection built for us. So, it can automatically create a compliant or non-compliant query for the baseline that we selected and therefore saves us some steps in building the query manually.