Abstract: An information handling system includes an embedded controller and a memory device storing code that when executed causes the embedded controller to perform operations that includes receiving a request to change a security setting, determining a security policy associated with the security setting, and determining whether the change to the security setting deviates from the security policy. In addition, the embedded controller in response to determining that the change to the security setting deviates from the security policy, denying the request and reverting the change to the security setting.