Security assessments
Security Configuration Assessment
A technical review of system and device configurations against recognized security baselines, identifying hardening gaps before they are exploited, covering Windows and Linux hosts, administrative privilege, logging, and network-facing configuration.
Problems this addresses
- Systems built from inconsistent or undocumented baselines
- Unclear configuration drift since initial deployment
- Administrative privilege broader than necessary
- No recent third-party review of hardening posture
Who this is for: Organizations that want an independent configuration review before implementing hardening changes, or that need to validate configuration against a recognized baseline such as CIS Benchmarks.
Scope
- Windows endpoint and server configuration
- Linux server configuration
- Local and domain security policy
- Administrative privilege review
- Host-based firewall configuration
- Unnecessary services and attack surface review
- Logging and audit policy configuration
- Encryption at rest where applicable
Methodology
- 01Baseline selection, typically CIS Benchmarks appropriate to the platform
- 02Configuration data collection from in-scope systems
- 03Comparison against the selected baseline
- 04Risk rating accounting for configuration drift and compensating controls
- 05Remediation guidance with implementation and rollback notes
Deliverables
- Executive summary
- Configuration findings register mapped to baseline controls
- Configuration drift summary where a previous baseline exists
- Prioritized hardening roadmap
- Optional post-remediation validation
Frameworks referenced
- CIS Benchmarks (Windows, Linux)
- CIS Controls v8
What we need from you
- Read access to in-scope system configuration (local admin or equivalent, time-boxed)
- A defined list of in-scope systems
- A named technical point of contact
Out of scope
- Implementation of hardening changes (available as a security engineering engagement)
- Application-layer configuration outside the OS/platform baseline
- Cloud workload configuration (covered under the cloud security assessment)
Frequently asked questions
Will this assessment make changes to our systems?
No. This is an assessment of current configuration against a baseline. Approved changes are implemented separately as a hardening engineering engagement, with documented rollback steps.
What baseline do you use?
CIS Benchmarks are the default reference point for Windows and Linux systems. We'll confirm the specific benchmark version and profile level (for example, Level 1 vs. Level 2) that fits your operational requirements during scoping.