GCB/FCB Configuration Audit Software

1. What Are GCB and FCB

GCB (Government Configuration Baseline)

The National Institute of Cyber Security (NICS) under the Executive Yuan established a standardized set of security configurations (TWGCB) to govern government agencies' IT equipment (such as PCs, servers, and network devices). It functions like a security rulebook, specifying password strength, software update frequency, firewall settings, and more, keeping all computers in a secure state. TWGCB: settings modeled on the U.S. government configuration baseline, adapted for Taiwan's computing environment.

FCB (Financial Configuration Baseline)

For financial institutions, the Financial Supervisory Commission (FSC) released the “Financial Cybersecurity Action Plan 2.0” on December 27, 2022, strengthening security oversight. Drawing on the Cyber Security Management Act, it applies more rigorous hardening to the IT environment, adding items not covered by the original TWGCB, providing risk levels and explanations for each setting, and incorporating parts of the international CIS and STIG standards.

CIS (Center for Internet Security): a nonprofit organization founded in 2000, with core members from ISACA, IIA, ISC2, and SANS. Its Benchmark series is widely adopted by international financial institutions as a system hardening standard.

STIG (Security Technical Implementation Guide): a set of guidelines published by the U.S. Department of Defense, based on NIST Special Publication 800-53.

GCB / FCB Comparison

Comparison Item	GCB	FCB
Target Audience	Government and public sector agencies	Financial institutions
Reference Standards	TWGCB	TWGCB + CIS + STIG
Implementation Scope	Windows, Windows Server, PC Server, Linux	Windows Server, Linux

2. GCB / FCB Product Features

Customizable Dashboard Layout: Configure the visual layout of statistical charts on the dashboard homepage.

Permission Management: Assign management permissions by rank, department, job function, and more.

Enhanced Login Authentication: Supports two-factor authentication, one-time password verification, single sign-on, and services like Google.
Flexible Asset Management: Manage computers by unit/organization, or flexibly group them by application system or any set of designated hosts.

Secure Execution Architecture: Agents running on endpoint workstations connect to the management console to “pull” work instructions and return results, avoiding a directory-service-based central control architecture.
API Integration: Provides asset management (inventory), vulnerability patch management, and security configuration management modules, enabling external systems to integrate via Web API.
Exception Management: Can be flexibly adjusted according to agency operational needs.

3. GCB / FCB Advantages

Extensive Server Deployment Experience: Delivered server implementation services to more than 10 clients, including the New Taipei City Land Administration, Taoyuan International Airport, and Yilan County Government.
Linux Audit and Implementation Services: Linux deployment services for financial institutions, custom audit tools based on the CIS standard, and direct vendor support.
Comprehensive After-Sales Support: A Taiwan-based, in-house developer with strong project customization capability and high flexibility.
Highest Audit Market Share: Major domestic security audit firms use DragonSoft products as their tool for auditing government agency compliance.

4. GCB / FCB Audit Items

Audit Items

Account Security: Password policy, password length, account lockout policy, and related configurations.
Personal Computer Systems: Security options, user rights assignment, internet communication, autoplay, and more.
Firewall Settings: Windows Firewall public/private/domain profiles.
User Settings: Screen saver, internet communication, network sharing, attachment manager, and more.
Additional Software Asset Management System: Obtains an inventory of endpoint device assets to track and manage asset replacement.
Internet Explorer: Java permissions and ActiveX controls for the intranet and trusted sites zones.
Chrome Browser: Content settings, HTTP authentication policy, password manager, remote access, extensions, and more.

Configuration Baseline Audit Item Statistics

Item Count	TWGCB / TWGCB+	FCB	Total
Windows Server 2012 R2	714 / 13	92	819
Windows Server 2016	699 / 13	92	804
Windows Server 2019	696 / 13	92	801
Windows Server 2022	704 / 13	92	809
Red Hat Enterprise Linux 8	290 / 3	22	315
Red Hat Enterprise Linux 9	284 / 3	22	309

5. Which Operating Systems Does DragonSoft Support

Supports a wide range of operating systems: Windows, Windows Server, macOS, Red Hat, Ubuntu, SUSE, and Rocky.

Supports Multiple Operating Systems: Windows, Linux, macOS, AIX

NICS document: Apple macOS 15 Government Configuration Baseline Documentation (Preview)

6. DragonSoft's GCB / FCB Implementation Track Record

DragonSoft has extensive experience implementing and auditing GCB/FCB, with a strong track record across both government and financial institutions.

Unit	Government	Financial
Agencies
Clients

GCB/FCB is more than a regulatory requirement — it's a critical foundation for ensuring security across government agencies, financial institutions, and enterprises. Our audit tools help you achieve:

Effective security risk management
Assured regulatory compliance
Enhanced security protection capabilities

Download Product Catalog→

GCB/FCB Government & Financial Cybersecurity Configuration Audit Software