How do we stop drift returning?

Golden images, configuration as code and scheduled drift checks. Without those, any hardening exercise decays within months.

How does a configuration & hardening review engagement start?

With a short discovery conversation and a written view of scope, risk and the decisions to be made. That view is useful to you whether or not the work continues.

How is a configuration & hardening review engagement priced?

Scope and, where relevant, rules of engagement are agreed in writing before any work begins, and the engagement is a fixed fee for that scope or phased with a cost envelope per phase — so you know the cost and the boundaries up front. Larger pieces of work are broken into phases with findings delivered early rather than a single invoice at the end.

Cybersecurity · Secure

Configuration & Hardening Review

Q: Do we have to meet every benchmark item?

No. Benchmarks are a starting point, not a legal requirement. We record justified exceptions with compensating controls, which is what auditors and reviewers actually expect.

We review configuration across operating systems, databases, containers and network devices against a recognised baseline, and separate genuine risk from cosmetic deviation. Rather than hand you a benchmark pass rate, we rank deviations by how exploitable and impactful they are, so remediation goes where it counts. We record justified exceptions with compensating controls, which is what auditors and reviewers actually expect. We also help establish golden images and drift checks so the hardening survives the next build rather than decaying within months.

In short

Configuration and hardening review compares system settings against a secure baseline and reports the deviations that matter. It distinguishes the configuration gaps that create real, exploitable risk from the cosmetic ones a raw benchmark score would treat as equal.

Start a conversation

What we do

The work inside configuration & hardening review.

Baseline selection

We choose an appropriate benchmark for each platform and agree the exceptions that your operating reality justifies. A baseline applied blindly breaks legitimate functions and generates findings nobody can act on. Agreeing exceptions up front keeps the review focused on deviations that actually matter.

Configuration assessment

We review the actual settings across a representative sample of systems and images rather than a single reference build. Hand-built systems commonly drift from each other and from any standard. The sample reveals both the typical state and the outliers that carry the most risk.

Risk ranking

We rank deviations by exploitability and impact rather than by the number of benchmark items failed. A high benchmark-failure count can hide the two settings that genuinely expose a system. Ranking by real risk tells your team what to fix first and what can wait.

Baseline maintenance

We help establish golden images, configuration as code and scheduled drift checks so hardening persists beyond the review. Without these, any hardening exercise decays within months as new systems are built. The aim is a baseline that re-applies itself rather than one that erodes.

What you receive

Deliverables, in writing.

Documented output your teams keep and can act on without us in the room.

Selected baselines with agreed exceptions
Deviation report ranked by real risk
Hardened build or image recommendations
Drift detection approach

When this work helps

You may be facing this.

Systems are built by hand and differ from one another
An audit has asked how hardening is evidenced
Container images are inherited from public sources unchanged

How an engagement runs

Discover, assess, design, deliver.

01
Discover
Understand what matters most, the obligations in play, and what the organisation is genuinely trying to protect. We agree scope and rules of engagement in writing here, so testing is bounded and authorised before it begins.
02
Assess
Test and review the systems in scope, and establish real exposure rather than theoretical risk. We gather evidence for every finding, so severity reflects what we demonstrated rather than what is merely conceivable.
03
Design
Prioritise remediation, control improvements, and architecture changes against risk and effort. We sequence the work so the exposures that matter most are closed first, within what the team can realistically do.
04
Deliver
Support remediation, retest what was fixed, and help the practice hold as the environment changes. We confirm fixes actually closed the issue, rather than taking remediation on trust.

Where we work

Delhi, India — and wherever the work is.

Fidova delivers cybersecurity consulting and technical assurance from Delhi, India, and works with clients internationally; testing and review are performed remotely against your environments, with on-site work arranged when scope requires it.

Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.

Related services

Often needed alongside this.

Security Monitoring

Security monitoring is the continuous collection and review of the signals that reveal attacks in progress. Done well it collects the sources that genuinely matter, raises alerts people trust, and connects each alert to a defined response.

Risk Assessment & Compliance

Security risk assessment and compliance work identifies your real security risks and the obligations you must evidence. It brings both into a single picture, so that security investment and the evidence you owe customers, insurers and auditors are driven by the same assessment.

ISO 27001 Consulting

ISO 27001 consulting prepares an information security management system for certification, from scope definition through to internal audit. It establishes a system that is genuinely operated rather than one that exists only on paper, which is what an external auditor looks for.

All cybersecurity services

Questions