Core baseline: all platforms
- Full disk encryption enabled with recovery keys escrowed centrally
- Users do not hold local administrator rights by default
- Elevation requires a separate credential or an approval workflow
Endpoint Hardening Checklist
Hardening guides run to hundreds of settings, most of which nobody verifies afterwards. This baseline is the subset that materially reduces risk, with the deviation register that makes exceptions visible rather than silent.
What you get
- A baseline split into controls that matter most and secondary hardening
- Separate Windows and macOS sections
- A deviation register for documented exceptions
- A compliance view showing coverage across the fleet
How to use this template
- 1
Enforce through policy, not through a build document. Settings applied once during imaging drift. Enforce through your endpoint management platform so devices are continuously evaluated and remediated rather than checked at build time.
- 2
Start with the controls that stop the common attacks. Disk encryption, no local admin, application control, macro restrictions, and EDR cover most real-world endpoint compromise. Do those completely before working through the long tail.
- 3
Record deviations rather than silently excluding devices. Some machines genuinely cannot meet the baseline. Record which, why, for how long, and what compensates, otherwise exclusions accumulate until the baseline describes nothing.
What's inside
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Related templates
More free templates IT teams use alongside this one.
Security Operations
Get templatePatch Schedule Template
Patching breaks things, which is why teams delay it, which is why they get breached through something with a patch available for six months. This schedule is built around deployment rings, so a bad patch hits a pilot group of twenty people rather than the whole company.
Asset & Endpoint Management
Get templateIT Asset Inventory Template
Most asset registers die of one disease: nothing in the organisation forces them to be updated. This one is built around the three events that actually change an asset's state (assignment, repair, and disposal), so the register is maintained by the work rather than by an annual audit.
Security Operations
Get templateGolden Image Build Checklist
A golden image goes stale from the moment it is captured, and a six-month-old image means every new device spends its first hours downloading patches on an unprotected build. The refresh cadence matters more than the build quality.
Frequently asked questions
What are the most important endpoint hardening controls?
+
Full disk encryption, removing standing local administrator rights, application control, blocking internet-sourced Office macros, and a reporting EDR agent. These cover the majority of real-world endpoint compromise before any long-tail setting matters.
Should users have local administrator rights?
+
Not by default. Where elevation is genuinely needed, provide a separate admin credential or an approval workflow and log its use. Standing local admin converts a single phishing click into full control of the device.
How should hardening exceptions be handled?
+
Recorded in a deviation register with the reason, a compensating control, an approver, and an expiry date. Silently excluding devices from policy is how a baseline ends up describing a shrinking fraction of the fleet.