Server hardening (CIS, ANSSI)

Your servers hardened, and kept that way

We harden your Linux and Windows servers to recognised standards (CIS, ANSSI): SSH, firewall, auditd, patching, accounts, services, the Docker daemon. We capture a baseline, then monitor drift — so hardening isn’t a one-shot that’s quickly forgotten. A fixed fee per server, with no hourly billing.

You leave with a clear before/after report you can use as proof of compliance for an audit or your cyber insurance.

Who it’s for

• Organisations with exposed servers — web, app, VPN: you want to reduce the attack surface before it’s tested for you.
• Teams preparing an audit or cyber insurance — you need a documented baseline and a presentable compliance report.
• Teams wanting the baseline to hold — not hardening forgotten in six months, but drift monitored month after month.

The hardening pass, item by item

Every server goes through the same CIS-inspired checklist. Nothing is left to chance, and every accepted deviation is documented.

• SSH hardened: keys only, root disabled, algorithms filtered
• nftables firewall: default deny, open ports justified
• auditd + tlog logging of privileged sessions
• fail2ban / CrowdSec against brute-force and scans
• sysctl / kernel: network & memory hardening
• Account, sudo and SUID binary review
• Service minimisation: nothing listening without reason
• Docker daemon & container hardeningpro

From exposed to hardened

Features included

• Full CIS/ANSSI hardening pass, tested in staging
• Before/after report with remediation included
• Frozen baseline and drift monitoring (monthly or weekly by tier)
• Linux and Windows (WDAC/baseline on the Windows side)
• Automatic config-drift remediationpro
• Compliance report presentable to an audit or cyber insurer
• Planned window, no service downtime, with rollback
• Quarterly reviewsignature

Security included

Frequently asked questions

Pair prevention with detection — one contract, one invoice, one SLA.