Resources · Scripts & Tools
The same baselines and templates we use in engagements, free to download and use. Every file lists its SHA-256 checksum — verify before you run, exactly as you'd expect a security firm to tell you.
A CMMC 2.0 readiness checklist for defense contractors: the levels, how to scope FCI/CUI, and a family-by-family walkthrough of the NIST SP 800-171 controls behind Level 2. The PDF companion to our online checklist.
SHA-256
74bb8373fa157a7df61178f63021c3ecc0c1a1675b3f46e29c968a2189711df7Applies a conservative CIS-subset baseline to standalone Windows 11 machines: UAC, SmartScreen, SMB signing, LSA protection, Defender ASR rules, PowerShell logging, and audit policy. Includes a -ReportOnly audit mode and creates a restore point before changing anything.
SHA-256
9f8fc8afb7c314bf3e54369c7d9be3206097dc99b8e578e87936344baa8ec810Baseline hardening for Debian/Ubuntu servers: SSH daemon lockdown, UFW default-deny firewall, kernel and network sysctls, auditd with starter rules, and unattended security updates. Includes a --report-only audit mode and validates the SSH config before reloading.
SHA-256
d57d78d9e565f724e47c8fe922b2b644667d196f26a925203fcfcae1f97e556dA fill-in-the-blanks IR plan: severity matrix, roles and 24/7 contacts, phase-by-phase checklists, a notification obligations table to complete with counsel, communication templates, and a blameless post-incident review agenda.
SHA-256
5931c3b8f3f50730dea5126d9d2dde90ac2b005d797c721d50cd91a2bca16db8These tools apply conservative defaults, but every environment is different — read the script, run report-only mode first, and test before production. Want a reviewed, managed rollout instead? Talk to us.
Looking for guides and checklists instead? Back to all resources.
These scripts apply conservative defaults, but every environment is different. We can assess, tailor, and operate hardening across your fleet — talk to us.