There are hardening guides such as CIS controls and different analysis methodologies such as MITRE ATTACK that allow an in-depth analysis.
For the correct execution of a hardening process, the controls implemented by the clients must be compared with those that appear in the guides of international entities (Center of Internet Security, National Institute of Standards and Technology), nationals (National Cryptologic Center) and manufacturers such as Microsoft, Canonical, RedHat, Suse … etc.