Cyber Essentials Secure Configuration

Secure Configuration is one of the five Cyber Essentials technical controls. Its purpose is to reduce unnecessary opportunities for attack by ensuring devices, operating systems and applications are configured securely.

Modern systems contain hundreds of configurable settings, accounts, applications and services. Default configurations are generally designed for convenience and broad compatibility, not necessarily for the specific security requirements of your organisation. In other words, settings that may make life easier for you also make life easier for the hacker!

Cyber Essentials therefore requires organisations to remove or disable unnecessary functionality, change insecure defaults and configure security features appropriately.

The challenge is consistency. Checking one Windows PC is straightforward; establishing that tens, hundreds or thousands of devices continue to meet the same security baseline is considerably harder.

SecureX7 automates secure configuration assessment across supported systems, identifying settings that deviate from your required hardened baseline and providing a measurable compliance position.

Rather than simply reporting another failed security check, SecureX7's AI-powered actionable guidance explains the weakness, why it matters and what should be done to remediate it.

Continuous assessment also identifies configuration drift when previously compliant devices change.

Know your devices are securely configured — rather than simply assuming they are.

Cyber Essentials expects organisations to reduce the attack surface of in-scope devices by configuring them appropriately for their intended purpose.

This starts with changing insecure or unnecessary default settings. Default passwords should be changed, unnecessary accounts removed or disabled, built-in services disabled where not required (See the ‘Readers Choice Winner’ SX7 Windows 10 & 11 Hardened Services Guide) and security features configured to provide appropriate protection.

Users should only have access to the applications and functionality they actually require. Operating systems, applications and services that are unnecessary for the device's business purpose should be removed or disabled.

Automatic execution features that could allow files or applications to run without appropriate user authorisation should also be controlled.

The objective is not to make every device as restrictive as technically possible. It is to establish a secure, appropriate and repeatable configuration that supports the way the device is genuinely used.

For Windows environments, this might include account settings, services, security policies, browser configuration, network settings and operating-system security features.

A defined hardened-build standard provides a useful baseline. SecureX7 can then assess supported devices against that baseline, highlighting deviations and helping establish where corrective action is required.

Secure configuration turns good security practice into a defined and measurable standard.

One of the simplest principles in Cyber Essentials is also one of the most effective:

If you don't need it, remove it or disable it.

Every unnecessary application, service, account or piece of functionality potentially increases the attack surface of a device.

Software that isn't required still needs to be maintained and updated. A service running unnecessarily may create another route into the system. An old user account can provide access nobody intended to retain. Unused browser extensions and utilities can introduce vulnerabilities without delivering any business value.

The problem becomes more significant over time. Devices accumulate software, accounts and configuration changes, making today's environment very different from the original hardened build.

SecureX7 provides visibility into supported devices and their installed applications and configurations, helping identify unnecessary software, insecure settings and deviations from the approved baseline.

Its AI-powered actionable guidance adds context to each finding, helping teams understand whether something needs attention and what practical remediation should be considered.

This changes secure configuration from a one-off hardening exercise into an ongoing process:

Establish the baseline. Remove unnecessary exposure. Detect change. Remediate drift. Verify the result.

The CIS have long been established as the ‘go to’ authority on hardened configuration guidance. A US not-for-profit organisation that collaborates with all leading manufacturers and security expert resources to collate definitive guidance on hardening applications, platforms, operating systems and appliances. SecureX7 can provide CIS Benchmark-based configuration analysis of all devices and identify all opportunities to improve security. But because SX7 is built using embedded-AI, it doesn’t just give you a report with 400 failures, it can prioritise remediation work and provide all the actionable guidance you need in a step-by-step Workplan so that security is always being improved.

Secure Configuration overlaps naturally with the other Cyber Essentials controls and several areas deserve more detailed guidance.

User Access Control

Secure configuration and privilege management are closely connected. Users should not be able to make security-sensitive changes unless their role requires it.

SecureX7 brings these requirements together through automated configuration assessment, continuous monitoring and AI-powered actionable remediation guidance.

Define your baseline. Find the deviation. Understand the risk. Remediate with confidence.