These are free baseline security checklists for organizations covering Active Directory, web applications, and cloud — quick hygiene checks that complement, but do not replace, a professional penetration test.
They help Slovenian and European organizations with basic security hygiene and readiness for NIS2 requirements.
Active Directory - Basics
SMB signing and disabling LLMNR and NetBIOS block NTLM relay and lateral movement, while LAPS removes shared local-admin passwords. Learn more about Active Directory security.
- SMB signing enabled on all systems
- LLMNR and NetBIOS disabled
- LAPS implemented for local admin accounts
- Kerberos delegation properly configured
- Tiering model for admin accounts
Web Applications - Basics
HTTPS everywhere, security headers, and server-side input validation prevent session hijacking and the most common web application attacks. Learn more about web application security.
- HTTPS everywhere (no HTTP redirect without HSTS)
- Security headers (CSP, X-Frame-Options, etc.)
- Proper session handling
- Rate limiting on authentication endpoints
- Server-side input validation
Cloud - Basics
MFA, the least-privilege principle for IAM roles, and closed public storage buckets prevent most cloud misconfigurations that lead to breaches. Learn more about cloud security.
- MFA for all admin accounts
- Least privilege principle for IAM roles
- No publicly accessible S3/Blob buckets
- Audit logs enabled
- Regular access rights review
These checklists do not replace a penetration test — for a real assessment of your resilience, book a penetration test.
Compiled by Vid Grosek, lead penetration tester at Telprom d.o.o., Ljubljana, Slovenia.
Frequently Asked Questions
Do security checklists replace a penetration test?
No. Security checklists cover baseline hygiene and remove common misconfigurations, but they do not replace a penetration test, which uncovers real attack paths, vulnerability chains, and business-logic flaws that checklists cannot capture.
Who are these checklists for?
They are for Slovenian and European organizations that want to improve baseline security controls across Active Directory, web applications, and cloud, and prepare for NIS2 requirements.