How about using a hardening guide such as CIS as part of the build process?