IT security standards
The minimum security standard every system meets when GNT Security brings it under management. Clients with stricter requirements add controls on top of it.
Endpoint security
- Supported operating system versions only
- Centrally managed endpoint protection
- Disk encryption where the device supports it
- Screen lock and inactivity timeouts
- Regular patching of the operating system and key applications
Access control
- Named user accounts; shared logins removed wherever possible
- Least-privilege access to systems and data
- Administrative access limited and monitored
- Role-based access where the platform supports it
Identity and authentication
- Strong password policies on supported systems
- Multi-factor authentication wherever available
- Accounts removed promptly when staff leave
- Centralized identity where appropriate
Backup and recovery
- Defined backup targets for key data and systems
- A mix of local and offsite backups where appropriate
- Regular verification that backups succeed
- Periodic test restores of representative data
- Recovery objectives agreed for critical workloads
Network and perimeter
- Separate networks for trusted devices and guests where possible
- Minimal exposure of internal services to the internet
- Secure methods for remote access
- Documented network layout and addressing
- Regular review of open ports and forwarding rules
Operational practices
- Changes to critical systems are planned and documented
- Monitoring alerts are reviewed and acted on
- New software and services are evaluated before wide rollout
- Retired devices and drives are wiped or destroyed
- Standard build templates are used wherever possible
These baselines are a floor, not a ceiling. Some industries and environments require stricter controls, which are added on top of this foundation.