Free resource
Security Hardening Checklist
Practical controls across IAM, endpoint, network, application, cloud, and compliance. Aligned to NIST CSF 2.0, CIS Benchmarks, and SOC 2 Trust Services Criteria.
🔑Identity & Access Management
Enable MFA for all user accounts (hardware key or TOTP)
Enforce MFA on all admin-privileged actions (step-up auth)
Implement role-based access control (RBAC) with least privilege
Rotate service account credentials every 90 days
Disable default and shared accounts immediately
Review dormant accounts (>90 days inactive) quarterly
Enforce strong password policy: ≥16 characters, breach-detected list check
Use SAML 2.0 or OIDC SSO for corporate app access
💻Endpoint Security
Deploy EDR agent with kernel-level telemetry on all endpoints
Enable automatic OS and application patch management
Enforce full-disk encryption (BitLocker / FileVault)
Disable USB mass storage on corporate endpoints
Enrol all mobile devices in MDM with compliance policies
Enable remote wipe capability for all mobile devices
Block execution of unsigned code via application allow-listing
🌐Network & Perimeter
Deploy WAF with OWASP CRS in blocking mode for all web applications
Enable DDoS protection at the edge layer
Enforce TLS 1.2+ everywhere; disable SSLv3, TLS 1.0, TLS 1.1
Configure HSTS with minimum 1-year max-age
Segment network: DMZ, corporate, and OT/ICS zones isolated
Enable ingress and egress traffic inspection with anomaly alerting
Block unauthenticated access to administrative interfaces
🔨Application & Code Security
Run SAST on every pull request; block merge on high/critical findings
Run SCA for known vulnerable dependencies (SBOM)
Enforce API authentication on every endpoint — no anonymous routes
Validate and sanitise all user input server-side
Implement rate limiting on all public APIs
Use Content Security Policy headers; disable inline scripts
Set Secure, HttpOnly, SameSite=Strict on all session cookies
Store secrets in a vault — never in code, environment variables, or logs
☁️Cloud & Infrastructure
Enable cloud provider audit logging (CloudTrail / Azure Monitor / GCP Audit Logs)
Enforce MFA for all cloud console access
Scan container images for CVEs before deployment
Use network security groups with default-deny inbound rules
Enable backup encryption; test restoration quarterly
Restrict public S3 buckets / storage blobs by default
Scan infrastructure-as-code for misconfigurations (Terraform, CloudFormation)
📋Compliance & Monitoring
Collect audit logs for all authentication, authorisation, and data events
Retain logs for minimum 90 days (1 year recommended)
Set up alerting for failed login spikes, privilege escalation, and anomalous data access
Run annual penetration test and remediate findings within 90 days
Conduct phishing simulation exercises quarterly
Maintain an incident response plan and test it annually (tabletop exercise)
Map your control set to SOC 2, ISO 27001, or NIST CSF as appropriate
Automate this checklist with continuous monitoring
See how Threatstealth automates this →