Depending on your field this could be a "yeah duh" comment for you, but there is a whole set of related tools and standards for this that's common when you're d

Depending on your field this could be a "yeah duh" comment for you, but there is a whole set of related tools and standards for this that's common when you're doing compliance-related cybersecurity, especially on server OSes. There's SCAP https://en.wikipedia.org/wiki/Security_Content_Automation_Protocol https://en.wikipedia.org/wiki/Security_Content_Automation_Pr... then a popular set of tools that implements it, for example: https://www.open-scap.org/tools/ https://www.open-scap.org/tools/ However the rulesets "profiles" are flexible, one popular one is CIS.