Workstation Hardening Quick Check

About this program

Are your laptops actually hardened — disk encryption, local admin, screen lock, USB control?

Risks addressed

High Lost / stolen laptop exposes unencrypted data
High User running with local admin all day
Medium USB-based malware on workstations

Controls (7)

Full-disk encryption on every workstation
Critical

Full-disk encryption (FDE) protects all data stored on workstation hard drives or solid-state drives by encrypting entire volumes using algorithms such as AES-256. When properly implemented, FDE requires pre-boot authentication or secure key management (e.g., TPM-based unlocking), rendering data unreadable…

How to test + evidence

Testing procedure: BitLocker / FileVault / LUKS — 100% coverage tracked in MDM / RMM.

Evidence to collect: Encryption status report.
No standing local administrator rights
High

This control restricts the assignment of local administrator privileges on workstations and servers to prevent users from operating with elevated rights during normal business activities. Instead, privileged access is granted on a just-in-time or time-limited basis through tools such as…

How to test + evidence

Testing procedure: Users are non-admin by default; elevation via LAPS / Privilege Manager / sudo.

Evidence to collect: Group membership audit.
Screen lock + idle timeout
Medium

This control enforces automatic session locking on workstations, servers, and mobile devices after a defined period of user inactivity, requiring reauthentication to resume access. The timeout threshold is typically set between 5 and 15 minutes depending on data sensitivity and…

How to test + evidence

Testing procedure: 15-min idle lock enforced via GPO / MDM.

Evidence to collect: Policy export.
Application allowlisting where feasible
High

Application allowlisting (also known as application whitelisting) restricts execution of code to a pre-approved list of applications, scripts, libraries, and executables. Rather than relying solely on blocklists of known malware, this control inverts the security model by denying execution of…

How to test + evidence

Testing procedure: AppLocker / WDAC / Gatekeeper for high-risk roles.

Evidence to collect: Policy export.
USB / removable media policy
Medium

This control establishes and enforces an organizational policy governing the use of USB drives, external hard drives, optical media, and other removable storage devices on enterprise systems. It typically defines approved device types, registration/authorization workflows, technical restrictions (such as read-only…

How to test + evidence

Testing procedure: USB mass storage blocked by default or routed through DLP scanning.

Evidence to collect: Endpoint policy.
Personal firewall on by default
Medium

This control ensures that host-based firewalls on endpoints (workstations, laptops, mobile devices) are enabled by default before deployment and remain active during operation. The personal firewall filters inbound and outbound network traffic based on defined rulesets, blocking unauthorized connections and…

How to test + evidence

Testing procedure: Host firewall enforced via policy.

Evidence to collect: Policy export.
Local browser config managed (cookies, downloads)
Low

This control ensures that web browser configurations—including cookie acceptance policies, download handling, and privacy settings—are centrally managed and enforced across endpoints through Group Policy, mobile device management (MDM), or configuration management tools. Managed browser configurations prevent users from disabling security…

How to test + evidence

Testing procedure: Browser policy template applied via GPO / MDM.

Evidence to collect: Policy export.