Secure Configuration Review
Against CIS Benchmarks
and DISA STIGs
Secure configuration review
Expert Hardening Review of the Systems Your Business Runs On
iSpyCyber reviews the configuration of your servers, databases, network devices, firewalls, endpoints and SaaS platforms against CIS Benchmarks, DISA STIGs and vendor guidance. We separate the settings that genuinely expose you from the noise, and give your teams a prioritised, practical hardening plan.
Why organisations choose iSpyCyber
Benchmark-aligned
Every system assessed against the relevant CIS Benchmark, DISA STIG or vendor hardening guide.
Risk over checklists
Deviations are prioritised by real exploitability and business impact, not treated as equal compliance failures.
Near-zero noise
Automated audit output is reviewed by hand, so your team only acts on settings that matter.
Practical hardening
Exact settings, commands and group policy paths, with notes on operational impact before you change anything.
Low-impact assessment
Read-only collection through credentialed audits or configuration exports, with no changes to live systems.
Drift under control
Re-review confirms every fix, and iefyx, our AI-native VAPT and CTEM platform, keeps exposure visible between reviews.
Coverage
What We Review Across Your Estate
Our specialists review configuration across on-premises, cloud and SaaS systems, focusing on the settings attackers exploit most.
Servers
Windows Server and Linux hardening, services, accounts, auditing, patching and remote access settings.
Databases
Oracle, SQL Server, MySQL, PostgreSQL and MongoDB authentication, privileges, encryption and auditing.
Firewalls
Rule base review for overly permissive, shadowed and unused rules, plus management plane security.
Network devices
Routers, switches, wireless controllers and load balancers checked for weak protocols and default settings.
Endpoints
Windows and macOS workstation hardening, local admin rights, disk encryption and endpoint protection settings.
Microsoft 365
Entra ID, Exchange Online, SharePoint and Teams settings, conditional access and audit logging.
Google Workspace
Admin roles, sharing controls, MFA enforcement, email security and data protection settings.
Directory and group policy
Active Directory security settings, group policy baselines, privileged groups and password policy.
Cloud and virtualisation
Hypervisors, virtualisation management and cloud workload baselines aligned to CIS guidance.
Methodology
A Proven Six-Phase Review Methodology
Aligned to CIS Benchmarks, DISA STIGs, vendor hardening guides and NIST SP 800-123, and tailored to your systems and risk.
- CIS Benchmarks
- DISA STIGs
- NIST SP 800-123
- NIST SP 800-53
- CVSS 3.1
1–3
weeks for a typical engagement
6
standards-aligned phases
100%
findings manually validated
01
- Days 1–2
Scope and plan
Systems, baselines, sampling approach and collection method agreed up front.
Key activities
- Confirm systems, platforms and sample sizes
- Select benchmarks and profile levels
- Agree access and collection method
- Output: Agreed scope and baseline selection
02
- Days 2–4
Collect
Configuration gathered through credentialed audits, exports and read-only console access.
Key activities
- Run credentialed configuration audits
- Collect device and firewall exports
- Review SaaS admin consoles
- Output: Configuration evidence set
03
- Days 3–7
Benchmark analysis
Configuration compared against the selected CIS Benchmarks, DISA STIGs and vendor guidance.
Key activities
- Compare settings against selected baselines
- Review firewall rule bases line by line
- Identify drift between similar systems
- Output: Baseline deviation list
04
- Days 5–9
Risk validation
Deviations assessed for real exploitability and prioritised by business impact.
Key activities
- Validate exploitability of key deviations
- Confirm compensating controls
- Rate every finding by risk and effort
- Output: Validated, prioritised findings
05
- Days 9–12
Report and debrief
Executive summary, detailed findings and a live walkthrough with your IT, security and leadership teams.
Key activities
- Executive summary for leadership
- Per-system findings with exact fix settings
- Live walkthrough and Q&A with your teams
- Output: Final report and debrief
06
- After remediation
Fix and re-review
Hardening support and re-review to confirm every issue is closed.
Key activities
- Engineer Q&A while changes are applied
- Re-review every remediated setting
- Updated report confirming closure
- Output: Re-review report
Effort distribution
Where the assessment time goes
Most of every engagement is spent on expert analysis and risk validation of configuration, not on running audit tools. Percentages are indicative for a typical review.
Quality built into every phase
Every deviation checked
Automated results are confirmed by a specialist.
Risk rated in context
Priority reflects exposure and compensating controls.
No changes to live systems
Collection is read-only and agreed in advance.
Closure confirmed
Re-review proves each change is in place.
Engagement models
Choose the Review Approach That Fits Your Estate
Every approach uses the same methodology. The difference is how many systems we cover and how deeply we validate.
Sample-based review
Representative builds for each platform reviewed in depth. Best for standardised estates and establishing a hardening baseline.
Full-scope review
Every in-scope system, device and platform reviewed individually. Best for audits, regulated environments and critical infrastructure.
Gold build review
Your standard images, templates and group policies reviewed before deployment. Best for preventing misconfiguration at source.
Not sure which approach you need?
Our specialists will recommend a scope based on your systems, platforms and compliance obligations.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Clear business context for decision-makers, precise technical detail for administrators and evidence your auditors can rely on.
Executive summary
Overall hardening posture, key themes and business risk in plain language for leadership and boards.
Technical findings
Every deviation with risk rating, affected systems, current and recommended values and benchmark references.
Hardening roadmap
Prioritised changes with exact settings, commands and operational impact notes, highest-risk issues first.
Re-review report
Independent confirmation of which findings are closed, ready to share with customers and auditors.
Supports your compliance and assurance requirements
- CIS Benchmarks
- DISA STIGs
- ISO/IEC 27001
- PCI DSS
- SOC 2
- NIST SP 800-53
- DPDP Act 2023
- CERT-In guidelines
- RBI guidelines
- HIPAA
- GDPR
iSpyCyber provides independent security testing that supports these requirements. Certification and attestation are issued by accredited bodies and licensed auditors.
Configuration review for every industry
FAQ
Secure configuration review questions, answered
Can’t find what you need? Talk to our security team.
The basics
What is a secure configuration review?
A secure configuration review is an assessment of how your systems, devices and platforms are set up, compared against recognised hardening baselines such as CIS Benchmarks and DISA STIGs, with each deviation prioritised by risk and paired with a clear fix.
Which systems can you review?
We review Windows and Linux servers, databases, firewalls, routers, switches, wireless controllers, endpoints, Active Directory, Microsoft 365, Google Workspace and virtualisation platforms.
What is the difference between CIS Benchmarks and DISA STIGs?
Both are detailed hardening baselines. CIS Benchmarks are consensus-based and widely used across industries, while DISA STIGs are published by the US Defense Information Systems Agency and are common in government and defence environments. We use whichever suits your requirements.
How is this different from a vulnerability scan?
Vulnerability scans focus mainly on missing patches and known flaws. A configuration review examines how systems are set up, including permissions, protocols, logging and policies, which scanners often miss.
Working with us
Will the review affect our systems?
No changes are made. We collect configuration through read-only credentialed audits, exports or console access agreed with you in advance.
Do you re-review after we apply the fixes?
Yes. We re-review remediated settings and issue an updated report confirming which issues are closed.
Get started
Harden Every System.
Without Breaking Operations.
Talk to our specialists about a scoped secure configuration review for your servers, devices and platforms.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries