END / END-02
Workstation, server and baseline-image hardening
Remove unnecessary functionality and apply reproducible security settings to systems. Hardening must remain compatible with business use and be maintained through changes and updates.
WHEN IT HELPS
A focused response
to a defined need.
Manually configured systems, excessive local privileges, unnecessary services, new fleet deployment or an audit finding recurring weaknesses across machines.
SCOPE & OUTCOMES
What the engagement covers.
Scope
- Tailored baseline
- accounts and services
- network configuration
- encryption where needed
- logging
- updates
- reference image
- pilot
- drift and exception checks
Deliverables
- Documented baseline
- versioned scripts or policies
- image if included
- technical compliance results
- application tests
- exception register
- maintenance procedure
Acceptance evidence
Agreed controls are applied or justified; business tests pass; new-device provisioning is reproducible; later drift is detectable; rollback is verified.
DELIVERY
How the work is structured.
Approach
Inventory versions and applications; define policies; test on a representative group; deploy; verify coverage and exceptions; organise maintenance.
Prerequisites & responsibilities
Customer: inventory, deployment tools, support, application owners and windows. Provider: policies and integration; alert handling only if included.
Scope factors
Devices, OSs, compatibility, existing tools, policies and deployment effort. Subscriptions, daily management and SOC coverage are priced separately.
Questions to clarify
Which systems and versions are in scope? Which applications need exceptions? How are new machines deployed and updated?
IMPORTANT BOUNDARIES
The baseline is tailored to the systems and their use, using applicable benchmark versions and licence conditions. Configuration scores are indicators, not proof that all vulnerabilities are absent.
Unsupported systems, exclusions and operational gaps are made explicit. Regression tests, fallback and response ownership are part of delivery.
IN PRACTICE
Illustrative situations.
These examples describe possible engagements and target outcomes. They are not customer references or achieved results.
Scenario 01
A company builds every server manually. Project: create a hardened image and automate settings. Target outcome: consistent configurations with explicit exceptions, without embedding secrets or unique identifiers into the image.
Scenario 02
A firm wants to remove workstation administrator rights. Project: identify legitimate needs, test applications and introduce controlled elevation. Target outcome: practical least privilege with a support process.
Technology and reference context
Examples: CIS and vendor guidance, central configuration management, automation tools and validated images for the customer’s operating systems.
The final technology set is agreed during scoping, based on interoperability, licensing, access rights and operating requirements.
CONNECTED SERVICES
Build the next step.
These services can complement the engagement. They are not automatically included.
START A CONVERSATION
Make the scope clear.
We will clarify the objective, dependencies and responsibilities of this service before proposing delivery.