Build Series Vol. 07 — Endpoint Hardening & Configuration

Baselines per system class, enforced continuously and measured for drift, across a fleet that includes machines you do not manage and cannot reach on a network.

The decision this volume is really about: tailoring the baseline with documented deviations, and scoring conformance per class rather than in aggregate.

Control mapping first. The exact SOC 2, ISO 27001:2022, NIST CSF 2.0, CIS v8.1, CMMC, PCI DSS v4.0.1 and HIPAA clauses this build satisfies are printed before any installation step, so the work becomes audit evidence rather than a side effect of it.

A validation harness, not just a build. How to prove the control works and — the part nothing free covers — how to catch it failing quietly: the expired scan credential, the canary that stopped, the encryption key nobody can recover, the segmentation your diagram claims and your firewall does not.

Three sized architectures with honest hour counts. Tier 1 is 30–50 hrs to build · 5–8 hrs a month.

Stack: CIS Benchmarks · OpenSCAP · Wazuh SCA · Ansible · MDM.

Current as of August 2026. The Windows Production PCA 2011 Secure Boot certificate expires on 19 October 2026; devices without the 2023 certificates keep booting but stop receiving boot-level protections. Also: CIS Benchmark PDFs are free, but the automated content is not — OpenSCAP and Wazuh SCA are the free automated paths.

Every volume runs the same nine sections: prerequisites, control mapping, the decisions that matter, three sized architectures, a build runbook, a validation harness, an evidence pack, an operating cadence with honest hour counts, failure modes and the buy line, and an AI prompt pack.

Reading order: read 8th of ten. Each volume stands alone, and each is cheaper to build if the one before it exists.

Ships without support. This is a document, not a service contract — and Section 8 tells you plainly where the buy line is.