Security Baselines

Choose the right security baseline for your organization. Each level builds on the previous, adding more controls and stricter enforcement.

Recommended
L1

Recommended Secure

Most organizations. Ideal starting point.

Protects against common attacks without disrupting daily work. Blocks credential theft, legacy vulnerabilities, and unauthorized access.

26 controls
9 critical
  • Stops common identity attacks
  • Aligns with CIS and Microsoft defaults
  • Avoids lockouts
  • Builds trust in TrueConfig recommendations
CIS MicrosoftMicrosoft Secure
L2

Enhanced Security

Security-conscious teams ready for just-in-time access.

Adds time-limited admin access and advanced threat detection. Admins activate permissions only when needed, reducing your attack window.

20 controls
4 critical
  • Everything in Level 1
  • PIM required for privileged roles
  • Phishing-resistant MFA for admins
  • Device compliance requirements
CIS MicrosoftMicrosoft Zero
L3

Maximum Security

Regulated industries, government, or high-risk targets.

Hardware-backed authentication, real-time threat containment, and continuous monitoring. Designed for zero-tolerance security requirements.

9 controls
5 critical
  • Everything in Level 2
  • Phishing-resistant MFA for all users
  • Hardware security key requirements for admins
  • Full just-in-time access for all privileged roles
CIS MicrosoftNIST 800-53

Quick Comparison

FeatureLevel 1Level 2Level 3
Enforcement ModeAdvisoryAuto-RemediateStrict
PIM Required-
Phishing-Resistant MFA-Admins OnlyAll Users
Device Compliance-Admins OnlyAll Access
License RequiredFreeP1/P2P2

Not sure which baseline to choose?

Start with Level 1 (Recommended Secure) and let TrueConfig guide you. You can always upgrade to a higher level as your security program matures.