Hardening settings fail in the air, not on the drawing board. A configuration that scanned clean yesterday can lock out the dispatch desk tomorrow. Pilots solve this with a preflight, and the same discipline transfers. SecOps — the Atlas’s SecOps reference page states it best — is a working agreement in which the security side owns hardening baselines and the operations side runs them, joined by a single remediation queue — every finding attached to a named person and a due date — plus exceptions that expire unless actively renewed, and figures read jointly by both camps. Neither the alert-watching centre nor a product that shares the name qualifies. What follows is a twelve-check preflight to run before any baseline moves from logging to blocking. Print it, tick it, argue with it. Every check you skip is a finding waiting for a bad week.
Ground checks: the SecOps paperwork
Check 1 — the agreement exists in writing. Which team fixes what, by when, and who accepts an exception. If the answer lives in folklore, stop here. Nothing downstream works without it.
Check 2 — one benchmark, one level, named. CIS publishes over a hundred benchmarks, Level 1 for workable defaults and Level 2 for stricter, costlier settings. DISA’s STIGs, plus the Security Compliance Toolkit from Microsoft, cover other estates. Pick the source and record the level. Two teams pulling from different documents will drift apart within a quarter.
Check 3 — the tailoring is written down. A benchmark applied raw is a benchmark nobody lives with. The tailoring file (XCCDF format) records every deviation and its reason. Six months later, that file is the only defence against “why can’t we…?” questions.
Check 4 — the emergency path is priced in advance. NIST calls emergency patching “highly accelerated” and leaves the number to you. BOD 26-04 from CISA (June 2026) supplies a public yardstick: three days to close the ugliest pairing of active exploitation and exposure, fourteen or sixty days for the rest — binding on federal civilian agencies, instructive for everyone else. Agree now what “urgent” means for you, because nobody negotiates calmly at 2 a.m.
Run-up checks: SecOps proof away from production
Check 5 — a rehearsal machine saw the settings first. The lifecycle is unforgiving about sequence: select, tailor, test off production, then listen, then enforce. A scratch host that mimics the real one catches the lockouts before users do.
Check 6 — the quiet phase ran long enough to mean something. A log-only stretch, or a small pilot ring left to settle, turns guesses into events. Shortchanging that cooling-off period to hit a date is how big-bang rollouts earn their reputation.
Check 7 — somebody actually read the evidence. Microsoft’s staged Netlogon enforcement for CVE-2020-1472 remains the model: from 11 August 2020, denials appeared as events 5827 and 5828, permitted legacy connections as 5830 and 5831, and event 5829 named machines still dependent on the vulnerable channel. The exit condition was the exception group — the one permitting those vulnerable Netlogon secure channels — standing empty ahead of the 9 February 2021 hard stop. One honest caveat: Microsoft does grant that the standard-protection ASR set can “usually” jump to Block or Warn untested. A sanctioned shortcut for one rule family is not a licence for all of them.
Check 8 — every exception has an expiry. “Temporary” exceptions without review dates are permanent in disguise. Each one needs an owner, a reason, and a date when it dies or is renewed on purpose.
Cruise checks: keep it honest after go-live
Check 9 — the watchers are being fed. If alerts depend on your telemetry, that dependency is a duty. CIS Control 8 sets the floor: an IG1 estate handles the logging process, the audit logs, and their storage (8.1–8.3), while IG2 raises the bar with synchronised clocks (8.4), one central home for logs (8.9), retention past ninety days (8.10), and weekly review sessions (8.11). Add a shared change calendar and pre-agreed containment authority so the night crew never negotiates scope mid-incident.
Check 10 — the tools themselves are fenced. Scanners, root and SYSTEM agents, SOAR tokens: these sit inside the trust boundary and deserve domain-admin-grade handling. Whoever can edit a routing rule can quietly erase a finding, and the record with it. Restrict and log that edit path.
Check 11 — the scorecard reads by cell, not by average. NIST dismisses estate-wide “percent patched” as not actionable. Report on-time completion per cell — asset importance crossed with urgency — plus median and p90 remediation times. In one real September scorecard, an 82.5% overall figure concealed a 95% cell (internet-facing, high urgency) and a 75% cell (datacentre, high) starved of a change window. The average was the lie.
Check 12 — drift watching and the yearly review are on a calendar. Configurations rot quietly. Scheduled drift checks catch the rot; an annual review catches the benchmark itself going stale. Neither happens by accident, and both are cheap when planned.
The preflight habit is the point
The shape, compressed for the kneeboard:
- Ground: agreement written, benchmark and level named, tailoring filed, emergency path priced.
- Run-up: rehearsal host, quiet phase, evidence read by a human, exceptions expiring.
- Cruise: telemetry flowing, tools fenced, per-cell scorecard, drift and yearly review scheduled.
Twelve checks, maybe forty minutes the first time, minutes once it is routine. Student pilots will recognise the shape from a flight school admission checklist: the value is not in any single line but in refusing to skip lines under pressure. If the infrastructure side of the house needs deeper grounding, the path through mastering infrastructure engineering pairs well with this discipline, and the curious can round out their toolkit with a survey of smart IT tools. Fail a check? Fix it on the ground. That is the whole culture, in the air or in the server room.
