Over the years I have used a number of different sources of security configuration guidance for a spectrum of systems including for example:

Given that there are so many different sources, in an attempt to prune the option space, do the following rules make sense?

  1. First, follow government direction;

  2. Second, in the absence of government direction follow the manufacturer's recommendation;

  3. Third, in the absence of a manufacturer's recommendation follow the best practice authorities (eg. CIS) recommendation.

But since multiple best-practice authorities my provide alternate hardening advice for the same system, are there any criteria for preferring one best-practice authority over another (eg. CIS or Stig)?

PS I can't work out if NSA's Information Assurance function is still providing this kind of guidance - are they still in the business of doing this?

  • 1
    Security configuration best practice/guidance also completely depends on your region and industry. For example if you are in health care, deal with PII/PHI and the US there is HIPAA/HITECH. If you work with UK government/agencies there is the GPG13/PMO guide to think about.
    – NASAhorse
    Nov 5, 2018 at 18:16

2 Answers 2


RFC 1925: line 10: One size never fits all.

So there was never such best-practice security approach for all.

It depends on what your focus/policy compliance strategy. General harden I think we should follow general guides on each system/os such as Windows security documents or Redhat security guides because it will balance the security/troubleshoot time as your links above.

If your environment focus more about security then stick with STIG/What-ever-certificate compliance checklist and spend more time to troubleshoot why it's not working.


In terms of Information Assurance I think frameworks like NIST would come first that would assess risk and then reference government and industry hardening guides.

If you are trying to "prune" the options then this is where threat and risk assessments help.

I've used the NSA router hardening guide with Cisco best practice documention. I wouldn't rate one above the other, it all comes down to risk management and justifying the mitigations you are putting in place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .