Enterprise Cybersecurity Checklist – Interactive

Enable Multi-Factor Authentication (MFA) for all users (preferably phishing-resistant methods like FIDO2 keys or certificate-based)

Implement Conditional Access policies (require compliant devices, approved locations, risk-based blocks)

Use Privileged Identity Management (PIM) and Privileged Access Workstations (PAW) for admin accounts

Enforce least-privilege role assignments and conduct regular entitlement reviews

Block legacy authentication protocols and enforce modern authentication (OAuth2)

Enable Entra ID Protection (risk detection, risky sign-in remediation, self-remediation)

Use passwordless authentication where possible and ban common/weak passwords

Harden the Entra ID Connect server (place in Tier 1, restrict RDP/admin access, apply security baselines)

Use least-privilege service accounts for synchronization (no Domain Admin rights)

Enable staging mode server for high availability and testing changes

Configure password hash sync or Pass-through Authentication with PTA agent hardening

Enable seamless SSO and monitor sync health via Entra Connect Health

Regularly review and minimize synced attributes/OU filtering

Monitor Entra Connect logs and alert on sync errors or credential changes

Implement Tiered Administration Model (Tier 0: Domain Controllers/AD Admins, Tier 1: Servers, Tier 2: Workstations)

Protect Tier 0 accounts with dedicated PAWs and restrict logon to secure hosts only

Enable LDAP signing, LDAPS, and channel binding; disable NTLM where possible

Apply Microsoft Tier 0 hardening baselines to Domain Controllers (restricted services, firewall rules)

Regularly audit privileged group membership and implement time-bound/just-in-time access

Enable Advanced Audit Policy (credential validation, Kerberos events, privileged use)

Deploy Microsoft LAPS (Local Administrator Password Solution) across domain-joined systems

Isolate CA servers in Tier 0 and restrict administrative access

Review and restrict certificate templates (disable vulnerable ESC1-8 templates, enforce manager approval)

Enable certificate enrollment logging and monitor for suspicious requests

Use NDES/SCEP only with strong authentication and Intune integration

Regularly rotate CA keys and implement HSM-backed protection where possible

Disable HTTP-based enrollment (CEP/CES) if not required; enforce HTTPS

Deploy dedicated hardened PAWs for all Tier 0/1 administration (no email/web browsing)

Enforce Device Guard/Credential Guard, AppLocker/WDAC, and BitLocker on PAWs

Restrict PAW logons to privileged accounts only and block inbound/outbound internet access

Manage PAWs via dedicated Intune policies or separate OU with strict GPOs

Monitor PAW usage and alert on deviations from baseline

Enroll all corporate devices in Intune (Autopilot for Windows, ADE for iOS/macOS)

Define and enforce device compliance policies (encryption, OS version, jailbreak/root detection)

Deploy Endpoint Security baselines (Defender for Endpoint, firewall rules, ASR rules)

Enable BitLocker with TPM+PIN, Windows Hello for Business, and LAPS on workstations

Implement App Protection Policies (MAM) and restrict data transfer between managed/unmanaged apps

Regularly patch workstations via Intune/WSUS and enforce application allowlisting (AppLocker/WDAC)

Apply Microsoft/CIS security baselines via GPO or Intune for all server roles

Remove unnecessary services, accounts, and disable SMBv1/NTLMv1

Enable Windows Defender with real-time protection and exploit mitigation (CFG, DEP)

Implement Just Enough Administration (JEA) for remote management

Restrict local administrator membership and use LAPS for local accounts

Disable SMBv1 and enforce SMB signing/encryption (SMB 3.1.1+)

Implement access-based enumeration (ABE) and least-privilege NTFS/share permissions

Enable File Server Resource Manager (FSRM) for file screening and ransomware detection

Configure detailed file access auditing and forward logs to SIEM

Use BitLocker or Azure Disk Encryption for volumes storing sensitive data

Regularly review and classify data; implement Dynamic Access Control where appropriate

Use least-privilege SQL logins and roles; avoid sa account usage

Enable TDE (Transparent Data Encryption) and Always Encrypted for sensitive columns

Configure SQL Server auditing and forward logs to central SIEM

Restrict network access (firewall rules, disable public interfaces)

Keep SQL Server patched and disable unnecessary features (xp_cmdshell, OLE Automation)

Harden IIS (remove default content, disable directory browsing, enforce TLS 1.2+)

Use dedicated service accounts with least privilege and managed service identities

Implement WAF (Web Application Firewall) and regular vulnerability scanning

Enforce secure headers (HSTS, CSP, X-Frame-Options) and secure cookie settings

Separate web, application, and database tiers with network segmentation

Follow 3-2-1 backup rule (3 copies, 2 media types, 1 offsite/air-gapped)

Enable immutable backups (e.g., Azure Backup immutability, Veeam hardened repo)

Use dedicated least-privilege backup service accounts with MFA where supported

Regularly test backup restores in isolated environment

Encrypt backups in transit and at rest; protect backup metadata

Monitor backup jobs and alert on failures or unauthorized access

Harden ESXi hosts using VMware security hardening guides (disable unnecessary services, lock down shell)

Use separate management network with VLAN isolation and restricted access

Apply least-privilege RBAC in vCenter and regularly audit permissions

Enable Secure Boot, TPM 2.0, and vSphere Trust Authority where possible

Keep vCenter and ESXi patched with latest security updates (use Update Manager)

Enable centralized logging (vCenter → SIEM) and monitor for anomalies

Implement VM encryption and restrict VM motion/creation for sensitive workloads

Implement network segmentation (VLANs/micro-segmentation) and Zero Trust principles

Deploy next-generation firewalls with IPS/IDS and regular rule reviews

Use encrypted site-to-site connections (IPsec VPN or SD-WAN with encryption)

Enforce remote access via VPN or ZTNA with MFA and device compliance checks

Perform regular vulnerability scanning and penetration testing of network infrastructure

Monitor traffic with centralized logging and threat detection (e.g., Defender for Cloud, SIEM)

Centralize identity, logging, and monitoring while respecting regional data residency requirements

Implement geo-redundant disaster recovery and backup strategies

Ensure compliance with local regulations (GDPR, CCPA, etc.) for data handling and storage

Use Content Delivery Networks (CDN) and traffic management for secure global access

Test incident response plans across regions with tabletop exercises

Conduct regular security awareness training tailored to regional threats

Maintain an up-to-date asset inventory and configuration management database

Deploy a Security Information and Event Management (SIEM) solution with alerting

Conduct regular third-party risk assessments and vendor security reviews

Establish and test an Incident Response Plan with clear roles and communication channels