Section 2
NCSC Control Pillar 2 – Secure System Configuration
Page 3 of 10
2.1 OS & Bloatware Removal
- • Uninstall unused server applications and IIS/Apache sample modules.
- • Disable USB AutoPlay and CD auto-run via GPO/MDM.
- • Decommission legacy protocols (SMBv1, Telnet, SSL v3).
2.2 Password & Passkey Rules
- • Enforce minimum 12+ character passphrases.
- • Integrate breach-database checks (e.g. HaveIBeenPwned API).
- • Roll out FIDO2 hardware keys for administrative roles.
Microsoft Office Macro Hardening Policy
GPO Path: User Configuration > Administrative Templates > Microsoft Word > Word Options > Security > Trust Center
Setting: Block macros from running in Office files downloaded from the Internet = ENABLED