What it asks for. Organisations should establish and maintain hardened configurations for end user devices, servers, network devices, cloud services and applications, replacing insecure vendor defaults. Configurations should be documented, applied consistently and kept from drifting.
In practice. Teams typically start from recognised hardening benchmarks, adapt them into internal standards and deploy them through configuration management, group policy, MDM or infrastructure as code. Default accounts are disabled or renamed, unnecessary services are removed, screen locks and host firewalls are enforced, and automated compliance scans detect drift. Evidence includes the approved baselines, deployment records, drift or compliance reports and exceptions with owners and review dates.
Common gaps. Baselines are often defined for servers but not for network gear, cloud tenants or SaaS settings. Drift goes unnoticed when compliance scanning is missing, and temporary exceptions quietly become permanent.