Hardening

Hardening is removing what you do not need: services, accounts, privileges, features and defaults.

Its advantage over adding controls is that removed things cannot be exploited, misconfigured or forgotten about. It is also where the friction is, because somebody always turns out to be using the thing you removed. Doing it at build time is straightforward; doing it to a running estate is a negotiation.