Home Blog The Complete Guide to System Hardening: Checklist and Best Practices Published: July 10, 2026 The Complete Guide to System Hardening: Checklist and Best Practices By: Brenda Buckman Summarize with AI Summarize ChatGPT Claude Perplexity Google AI System hardening is the process of configuring systems to reduce the ways an attacker can get in or move around once they're inside. A system hardening checklist gives IT teams a structured way to work through that process, covering areas like user accounts, network configuration, patch management, and logging. Think of it as a practical starting point for closing the gaps left by default settings. Your security is only as strong as your weakest link, or in this case, your weakest configuration. A system hardening checklist gives IT teams a practical, repeatable way to close the gaps attackers target: default credentials, open ports, unnecessary services, and misconfigured permissions. It's one of the most foundational elements of good cyber hygiene , and one of the most common oversights when teams are stretched thin. The problem is that hardening isn't a one-time task. Configurations drift, new systems get added, and exceptions pile up. This guide walks through every major category of hardening, from user accounts and network configuration to logging and physical security controls, so you have a clear starting point and a process you can actually maintain. What is system hardening? System hardening is the process of configuring systems to reduce the ways an attacker can get in or move around once they're inside. Think open ports, default accounts, unused services, or weak settings. Every one of those is a potential entry point, and hardening closes them off before someone can take advantage. It's also worth distinguishing between hardening and patching , because the two are often confused: Patching fixes known vulnerabilities in software Hardening changes how a system is configured, making those vulnerabilities harder to reach or exploit in the first place Both are important parts of vulnerability management , and neither one substitutes for the other. Why system hardening matters Out-of-the-box systems aren't built with security as the priority. They're built for ease of use, which means they often ship with open ports, enabled services, and default credentials that attackers actively scan for. Misconfigurations consistently rank among the top causes of breaches , and default settings are one of the most common culprits. There's also a compliance angle worth noting. Cybersecurity frameworks like CIS Benchmarks, NIST SP 800-53, and DISA STIGs all include hardening requirements, and organizations subject to HIPAA, PCI DSS, or CMMC need documented hardening practices to pass audits. Essentially, you need to meet a baseline of protections so that if a cyber event happens, you can clearly show that you've done your due diligence. Ultimately, a hardened system is tougher to compromise, cheaper to defend, and less likely to become the entry point for a ransomware attack or data breach. The work you put in up front pays off every time an attacker moves on to an easier target. The complete system hardening checklist This is the practical core of system hardening: A step-by-step checklist organized by category that IT admins can work through systematically. Not every item will apply to every environment, so use this as a starting point and adapt it to the systems you're hardening. For the most detailed guidance, cross-reference the relevant CIS Benchmark for your specific OS or platform. Description Type Governance User account and access controls Disable default accounts, enforce password policies, apply least privilege, and enable MFA for privileged access OS hardening CIS Benchmarks, NIST SP 800-53 Network configuration Restrict traffic with default-deny rules, disable unused ports and protocols, and segment networks to limit lateral movement Network hardening CIS Benchmarks, NIST SP 800-53 Firewall configuration Block all traffic by default and only open what's explicitly approved; log all inbound and outbound traffic Network hardening CIS Benchmarks, DISA STIGs Patch management and updates Establish a patch cadence for OS and third-party software; track and replace end-of-life systems OS hardening NIST SP 800-40 Windows-specific hardening Disable SMBv1, LLMNR, PowerShell v2; enable BitLocker, Credential Guard, and UAC; restrict RDP OS hardening CIS Benchmarks, DISA STIGs Linux-specific hardening Disable root SSH login, enforce key-based auth, enable SELinux or AppArmor, configure auditd OS hardening CIS Benchmarks, DISA STIGs Service and application configuration Disable unused services, run services under least-privilege accounts, remove default files, and debug settings Application hardening CIS Benchmarks Logging and monitoring Enable audit logging, centralize logs, set retention policies, and configure alerts for high-priority events OS hardening NIST SP 800-92, PCI DSS Physical security controls Restrict physical access, enable BIOS passwords, disable unauthorized boot options, and encrypt portable devices OS hardening NIST SP 800-53 1. User account and access controls The default accounts that ship with most systems are some of the first things attackers go after. Disabling or renaming the built-in Administrator account on Windows and creating named admin accounts in its place gives you accountability and removes an obvious target. On Linux, disable direct root login over SSH and require users to escalate with sudo instead. From there, you should also: Enforce a password policy with a minimum of 12 to 16 characters and complexity requirements Enable multi-factor authentication for all privileged accounts and remote access Apply least privilege across the board: users and service accounts should only have the permissions they need to do their job, nothing more Audit accounts regularly , disable anything inactive, restrict who can add accounts to privileged groups, and disable guest accounts on all systems 2. Network configuration Start by closing or blocking any ports your systems don't actually need, and write down which ones you've left open and why. That documentation will save you later. From there, go through your protocols and disable anything insecure. Telnet, FTP, SNMPv1/v2, and older SSL/TLS versions (TLS 1.0 and 1.1) have no business being on by default in 2026. Next: Segment your network so a compromised system isn't open to the rest of the network. Isolate servers from workstations and keep OT/IoT devices off corporate networks. Restrict management interface access (RDP, SSH, web admin consoles) to specific IP ranges or management VLANs Disable IP source routing and ICMP redirects on servers and network devices Configure DNS to prevent zone transfers to unauthorized hosts Log all inbound and outbound traffic so you have a record to work from if something goes wrong, or when it's time for incident response planning 3. Firewall configuration A perimeter firewall isn't enough. Enable the host-based firewall on every system and treat each one as its own line of defense. Set default-deny rules for both inbound and outbound traffic, then explicitly allow only what's needed. In addition: Restrict outbound traffic from servers. Servers generally shouldn't be initiating connections to arbitrary internet destinations Log firewall rule matches, especially denied connections, and review them regularly Test firewall rules after any configuration change to confirm they behave as expected 4. Patch management and updates Establish a patch cadence: Critical patches within 24 to 72 hours of release, high-severity patches within 7 to 14 days, and other patches within 30 days. Adjust based on your risk tolerance and environment. Enable automatic updates where appropriate, but test patches in a staging environment before pushing them to production servers. Don't limit this to the OS. Browsers, Java, PDF readers, and other third-party applications are frequent attack vectors and need to be patched regularly. Track end-of-life software and hardware, too, since those systems no longer receive security updates and should be replaced or isolated. As part of your patch management strategy, you should also maintain a full inventory of everything installed on each system, ensuring nothing is missed. 5. Windows-specific hardening Start by disabling Windows features and roles that aren't in use. Common candidates include PowerShell v2, SMBv1, LLMNR, NetBIOS over TCP/IP, and Windows Script Host if your environment doesn't rely on it. Enable Windows Defender or an equivalent endpoint protection solution, and keep definitions up to date. Configure AppLocker or Windows Defender Application Control (WDAC) to restrict which applications can run, and enable Credential Guard and Device Guard on supported hardware to protect against credential theft. From there: Disable autorun and autoplay for removable media Configure User Account Control (UAC) to prompt for credentials on all admin actions Enable BitLocker for full-disk encryption on workstations and laptops Restrict access to the registry and sensitive file paths using ACLs Disable Remote Desktop Protocol (RDP) on systems that don't need it; where RDP is required, restrict it to specific users and source IPs 6. Linux-specific hardening Start by disabling root login via SSH and requiring users to log in as themselves, then escalate with sudo for privileged commands. Configure SSH to use key-based authentication, disable password authentication, and restrict which users can connect. Set SSH to use a non-default port if practical. Next: Enable and configure a host-based firewall (iptables or nftables) with default-deny rules Remove or disable unused packages and services using the package manager Set file permissions correctly , as world-writable files and directories are a common misconfiguration Enable SELinux or AppArmor and set