A new laptop is set up for convenience. It works on the first boot, it talks to everything nearby, and it asks you very few questions. That is a fine default for a shop shelf and a poor one for a machine that holds customer data.
Hardening means changing those defaults on purpose and writing down which ones you changed. The writing-down part matters as much as the changing, because that is what you show when somebody asks.
The free baselines
You do not need to invent a configuration. Several free, well-maintained baselines exist, and most small teams only need one per platform.
Windows. Microsoft's Security Compliance Toolkit ships its recommended security baselines, plus Policy Analyzer for comparing a machine against them.
macOS. NIST's macOS Security Compliance Project is open source. It turns a chosen baseline into configuration profiles you can push through your device management tool, and into scripts that check whether a Mac still complies.
Nearly everything else. CIS Benchmarks cover operating systems, browsers, cloud accounts and network gear, as free PDFs after registration. The NIST National Checklist Program indexes checklists from many publishers, which helps when you need something for an unusual device.
The strict reference. DISA STIGs are written for the US Department of Defense and are demanding. Few small companies adopt one whole, but they are a useful second opinion when you are deciding how tight a setting should be.
Phones. NIST SP 800-124 Rev. 2 covers managing the security of mobile devices in an organization. The UK NCSC's device security guidance is shorter and more practical, and NSA's Mobile Device Best Practices fits on two pages you can hand to staff.
Pick one per platform
Choose a single baseline for each platform you run and apply it in full, then record the settings you deliberately left out and why. Mixing parts of three baselines is how a fleet drifts: nobody can say which source a setting came from, so nobody notices when it changes.
What an auditor will ask
The question is always some version of "how do you know every laptop matches your standard today?" A policy that says devices are hardened does not answer it. Evidence that does:
- a dated compliance export from your device management tool
- the output of a check script, such as the ones the macOS project generates
- a short list of exceptions, each with an owner and a reason
The frameworks put this in familiar places. ISO 27001 Annex A.8.9 covers configuration management and A.8.1 covers user endpoint devices. CIS Safeguard 4.1 asks for a documented secure configuration process.
Keeping the record
Keel's free policy templates include Access Control, Encryption and Authentication & Password policies, which state what your baseline has to enforce. Inside Keel, you upload the dated exports and script output to your evidence library and link each one to the control it proves, so next year's audit starts from this year's record rather than from memory.
Browse the free templates, or start free.
Next week: the printer, the camera and the smart TV, or IoT security for a small office.