Secure Configuration Baselines for Hospital Systems

Most hospitals have a hardening standard. Far fewer can tell you how many machines currently comply with it. That gap is the whole subject: a baseline is only a control if something measures against it and something reports the difference.

Pick a published benchmark, do not invent one

Writing your own standard from scratch means maintaining it forever and defending every clause in an audit. Start from something published and attributable:

For most hospital estates, CIS Level 1 is the right starting target. It is designed not to break things. Level 2 is where clinical exceptions start to multiply, so treat it as a goal for servers rather than a day-one requirement for clinical workstations.

The exception process is the real design work

Every hospital will have legitimate deviations: an application that needs SMBv1, a device requiring a local administrator account, an imaging workstation whose vendor forbids a particular patch level. Pretending otherwise produces a baseline everyone quietly ignores.

An exception should carry:

• The specific control being deviated from
• The clinical or vendor justification, named
• A compensating control — tighter segmentation, extra logging, restricted access
• An owner who is accountable, ideally on the clinical side
• A review date, not "permanent"

Golden images, and why they decay

Building a hardened image is the easy half. The hard half is that the image is correct only on the day it is built.

The drift sources that matter in hospitals:

• Vendor support sessions that disable a control to troubleshoot and never re-enable it
• Emergency changes made at 2am with no follow-up ticket
• Local administrator use by biomedical or application teams
• Group Policy conflicts where a newer policy silently overrides a hardening setting
• Machines that have been offline for months and miss policy updates entirely

Measuring compliance

The number that matters is not "we have a baseline" but "what percentage of in-scope systems match it, by system class, this week".

Cloud workloads usually score best for a structural reason worth copying: they are rebuilt from a definition rather than patched in place, so drift is short-lived. Where you can move clinical infrastructure toward rebuild-over- repair, baseline compliance largely takes care of itself.

A pragmatic sequence

Measuring before changing matters. It gives you the number that justifies the work, and it prevents the common failure of hardening aggressively, breaking a clinical system, and losing the mandate entirely.

GuardsArm runs configuration baseline assessments against CIS benchmarks in clinical environments, including the exception framework that keeps them alive. Book a scoping call.