MBSS Development · Secure configuration standards
One secure standard for every build.
We write the minimum security configuration each of your system types must meet, research it against vendor benchmarks and hardening guidance, and explain every control so your teams can build to it, check it and prove it.
Why it matters
Without a baseline, every build is a guess.
A security floor for every system
Each system type gets a defined minimum level of security, so sensitive information is protected the same way on every server and device.
Clear guidance for builders
Engineers and suppliers get written requirements to build against, instead of relying on memory, habit or a vendor's default install.
Requirements regulators expect
A documented baseline helps meet legal and regulatory duties to protect information, and gives auditors a standard to test against.
How we deliver
Five steps. A standard your teams will use.
Baselines only work when they fit your environment, so we build them with your system owners rather than handing over a generic template.
System inventory
We agree the system types in scope, such as operating systems, databases and network devices, and the versions you run.
Benchmark research
For each type we study vendor recommendations, hardening guidelines, security research institutes and trusted standards.
Fit to your environment
With your system owners we tailor each control to your business needs, regulations and operational constraints.
Write the standard
Each baseline sets the minimum configuration, describes every control and gives our recommendation for applying it.
Review and handover
We review the drafts with your teams, adjust them where needed and hand over final standards ready for approval.
What you receive
The systems covered, what goes inside each standard and how it is used.
Expected outcomes: a consistent security floor across system types, clear build requirements for teams and suppliers, and a standard auditors can test against.
01 · Define
Systems covered
Server operating systems
Databases
Network devices
Security appliances
Endpoints and workstations
02 · Specify
Inside each standard
Minimum security configuration settings
Best practices for the system type
A description of each control
Recommendations for implementation
03 · Govern
How it is used
Reference for new builds and rebuilds
Benchmark for configuration reviews
Evidence for legal and regulatory duties
Track record
Standards work grounded in ISO 27001.
Financial services · Jordan · 2025
ISMS maintained through ISO 27001 recertification
Tech & digital platforms · Jordan · Q4 2025
Internal audit against ISO 27001 delivered
IT Security C&T · ISO 27001
Our own ISMS is certified to ISO 27001
Baselines become policy in ExceedGRC.
Approved baselines can live in ExceedGRC as governed policies, mapped to the controls of ISO 27001, NCA ECC or SAMA CSF. Gap assessments then show which systems meet the standard, and the gaps flow into risk mitigation tracking instead of email threads.
Related services
Set the standard. Then check it holds.
A baseline defines what good looks like. These services check systems against it and keep your wider compliance programme aligned.
Low-Level Configuration Review
Check live systems against your new baselines and get a remediation for every setting that falls short.
Explore configuration reviewCompliance
Compliance programmes for NCA ECC, SAMA CSF, CBJ and PCI-DSS that your baselines can feed with evidence.
Explore complianceHigh-Level Architecture Review
Confirm the design around your systems is sound before baselines fix each component's settings.
Explore architecture reviewOperate & Maintain track
Network+, Security+ and CND pathways for the administrators who will apply and maintain your baselines.
View training tracksFAQ
Baseline standards, explained.
What IT and compliance leaders ask before commissioning security baselines.
What is a Minimum Baseline Security Standard?
A written set of minimum security configurations that a system type must meet, such as a server operating system or a database. It tells teams exactly how to build and harden that system to protect sensitive information.
Which systems should have a baseline?
Usually every system type that stores or processes sensitive information: servers, databases, network and security devices and endpoints. We agree the list during scoping, based on your environment and priorities.
Do you apply the baselines to our systems?
This service produces the standards. Applying them stays with your teams, and a low-level secure configuration review can later check how closely live systems match each baseline.
How do baselines relate to NCA ECC, SAMA CSF or CBJ rules?
Regulators expect documented, secure configurations. We take your applicable regulations into account, so the baselines help meet legal and regulatory requirements and give auditors a clear standard.
What information should we have ready?
A list of system types and versions, any existing hardening documents, and time with the owners of each platform so every control is realistic for how your systems actually run.
Start your baselines
Share what you run. We'll define the standard.
Share the system types in scope and the regulations you answer to, and a consultant will propose a baseline development plan.
Tell us your system types, versions and regulators
A consultant reviews your environment and needs
We return a baseline development proposal