Secure Configuration Compliance
Learn how to harden system settings, disable vulnerable defaults, and satisfy the second control of UK Cyber Essentials.
Watch: Implementing Secure Configuration & Defining Your Scope
Learn how to harden system credentials, remove bloatware, disable auto-run protocols, and define your exact audit scoping boundary under NCSC standards v3.3.
What is Secure Configuration?
Computers, servers, and network hardware are often shipped from the manufacturer with default settings optimised for ease-of-use rather than security. These default configurations frequently include pre-configured passwords, unneeded pre-installed software, and active administrative services that present a massive attack surface.
Secure Configuration means hardening these systems by turning off unneeded ports, removing default admin credentials, and ensuring security controls are explicitly enabled.
Default Password Danger
If any device in your organisation—such as a backup server, router, or even an office printer—is found running with its default manufacturer password (like "admin" or "1234"), your audit will automatically fail.
How to Secure Your Configurations
Change All Manufacturer Defaults
Change default usernames and passwords on all operating systems, applications, routers, and IoT devices. Ensure passwords are strong (at least 12 characters, or a passphrase) and unique.
Remove Unnecessary Software and Services
Disable or uninstall any pre-installed software, services, or protocols that are not required for daily business operations. This includes active legacy protocols like SMBv1, which are vulnerable to remote code execution.
Disable Auto-Run and Auto-Play Features
Disable auto-run and auto-play settings across all devices to prevent malware from executing automatically when USB drives, external media, or downloaded files are mounted.
Cyber Essentials Secure Baseline Hardening Checklist (2026 Audit Criteria)
Commercial operating systems and cloud services are delivered out-of-the-box configured for maximum usability rather than robust security. To satisfy NCSC Control #2, every device in your scope (Windows 11, macOS, mobile handsets, and Microsoft 365 tenants) must undergo systematic configuration hardening.
⚙️ Default Account Neutralization
Rename or permanently disable the built-in Administrator and Guest accounts. Remove pre-configured manufacturer support accounts. Verify that no accounts exist with null or blank passwords.
🚫 Unnecessary Services & SMBv1 Removal
Uninstall all vendor bloatware, trial utilities, and unapproved applications. Disable legacy network protocols such as SMBv1, NetBIOS over TCP/IP, and unauthenticated Telnet daemons across all internal subnets.
🔒 AutoPlay & AutoRun Lockdown
Enforce Group Policy (GPO) or Microsoft Intune profiles to permanently disable AutoPlay and AutoRun for all media drives. Malicious scripts mounted via USB must never execute without explicit user action.
⏱️ Screen Lock & Inactivity Timeout
Configure all workstations, laptops, and mobile devices to automatically lock display sessions after a maximum of 15 minutes of inactivity, requiring password, PIN, or biometric re-authentication to resume.
| Hardening Component | Windows 11 Standard | macOS Ventura/Sonoma | M365 / Cloud Standard |
|---|---|---|---|
| Account Lockout | Max 10 invalid attempts (GPO / Intune) | Password throttling / FileVault lock | Smart Lockout enabled in Entra ID |
| Disk Encryption | BitLocker enabled across all drives | FileVault 2 permanently ON | Encrypted at rest (AES-256) |
| Default Credentials | Built-in Admin disabled; unique LAPS passwords | Root disabled; standard user for daily use | Break-glass accounts protected with FIDO2 / MFA |
| Legacy Protocols | SMBv1 removed; LLMNR disabled | AFP disabled; SSH password auth off | POP3, IMAP, and Basic Auth blocked |
Enterprise Gateway Hardening Matrix: Fortinet, Cisco, SonicWall & Sophos
Under NCSC Cyber Essentials Controls #1 and #2, perimeter firewalls and security gateways represent the outermost defensive boundary. Unpatched manufacturer firmware, active WAN management ports, or factory admin accounts are leading attack vectors. Review the mandatory hardening rules below:
| Manufacturer / Model | WAN & Admin Interface Rule | VPN & Remote Access Hardening | NCSC 14-Day CVE Patching Rule | Audit Requirement |
|---|---|---|---|---|
| Fortinet FortiGate (201E, 60F, 100F, VM) |
Disable HTTPS/SSH on all WAN interfaces. Restrict administrative login to trusted internal subnets or dedicated management VLAN. Factory "admin" account password replaced. | Mandatory MFA on SSL-VPN / IPsec tunnels via FortiToken or Entra ID SAML. Disable unpatched web-mode SSL-VPN portals exposed to public internet. | Immediate upgrade for critical CVEs (e.g. CVE-2024-21762, CVE-2024-23113) within 14 calendar days of vendor release. | Mandatory for CE+ |
| Cisco Meraki & ASA (MX Series, ASA 5500-X, ISE) |
Block public ASDM and Telnet/SSH access from 0.0.0.0/0. Enforce 2-factor authentication on Cisco Meraki Cloud Dashboard accounts. |
AnyConnect VPN sessions must enforce MFA (Duo / Microsoft Authenticator). Terminate idle sessions after 15 minutes of inactivity. | Remediate known Cisco ISE, ASA, and Enterprise License Manager CVEs (CVSS 7.0+) within 14-day audit SLA. | Mandatory for CE+ |
| SonicWall TZ & NSA (SonicOS 7.x) |
Disable SonicOS Web Management on WAN interface. Enforce complex admin passphrases and account lockout threshold (max 5 attempts). | NetExtender / Mobile Connect SSL-VPN must require TOTP multi-factor authentication. Disable unused virtual office bookmarks. | Apply SonicWall Security Advisory hotfixes for SSL-VPN buffer overflow and access control flaws within 14 days. | Mandatory for CE+ |
| Sophos XGS & SG (SFOS Series) |
Block WebAdmin and User Portal access on WAN zone. Enforce default-deny inbound rule for all non-essential ports, especially port 3389 (RDP). | Sophos Connect VPN profiles integrated with Azure AD / RADIUS MFA. Enforce TLS 1.3 encryption ciphers. | Enable automatic pattern and hotfix installation for zero-day remote code execution vulnerabilities (CVE-2022-3236). | Mandatory for CE+ |