We are looking into reviewing our organization OS/DB hardening checklist (done by predecessor). We're aware that there are various benchmarks out there like CIS & STIG to guide on that, and the current checklist is rather a short list of items extracted from CIS benchmark. We planned to extend the list to include most items in CIS benchmark but are wonder if that is the right process.

To elaborate further, my organization has server admin and security operations separated, and my team is the latter which is tasked to come out with the checklist. We had a brief discussion with admin team and were informed that the list is too long and there must be items that is not required. But from security perspective/standpoint, we don't see any item should be excluded, these are the best practices and there is a reason they are included, and should be followed if we can unless it is not applicable (e.g. if we don't use Windows defender antivirus and therefore can ignore configurations for defender antivirus). We're also aware that some applications/processes might not able to comply to all, that will required further risk assessment/acceptance, but shall include all as baseline first before that.

In conclusion, we would think that all applicable items shall be included, even if the risk/possibility is low, but in terms of improving security/reducing risk, why not? It should not based on severity/impact/possibility. Would like to know whether this would be the correct approach and seek advice how is it done in other organization.

1 Answer 1


The term you are looking for is "risk management". Don't blindly apply security controls just because "they sound good". Controls exist to address risks. Make the risk your priority.

And the cost of a control must be lower than the impact of the risk materialising. Else, what's the point? If you spent $1000 (in time, materials, resources) to mitigate a risk that has a $50 impact, you've done something wrong.

So, use hardening guides as a guide for which controls matter for a particular asset.

  • Hi @schroeder, I believe I understand what you mean, maybe I didn't explained well, it is actually fall under the risk assessment and acceptance I mentioned above, which my process cannot comply (due to resource constrain or etc). But before these feedbacks come in and from a pure security standpoint, we should use all as the baseline to scan and evaluate further with respective teams. We were informed to exclude items by our own first, which is from security standpoint, before working with them, which is why I raise the question.
    – nlks
    May 12, 2023 at 0:56
  • Sure, like I said, if a control is known to be worth less than its benefit for that target or for that environment, then you can exclude that control. Just make sure you document which controls have been excluded and the reasons why.
    – schroeder
    May 12, 2023 at 7:47
  • In conclusion, I think all the items in the CIS benchmark can be included as a baseline in security standpoint (until they are evaluated). The result of that (we do use tool to scan for CIS compliance) is to be used to works with respective teams including server admin/app developer, evaluate the worthiness of the controls and going through the risk management process, and then finalize of the hardening checklist.
    – nlks
    May 14, 2023 at 18:57
  • yes, that's the way to go
    – schroeder
    May 14, 2023 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .