diff --git a/debian/ngcp-panel.service b/debian/ngcp-panel.service
index 9eadec59c6..2c1f008ade 100644
--- a/debian/ngcp-panel.service
+++ b/debian/ngcp-panel.service
@@ -16,6 +16,9 @@ RuntimeDirectoryPreserve=yes
 PIDFile=/run/fastcgi/ngcp-panel.pid
 ExecStart=/usr/share/ngcp-panel/ngcp_panel_fastcgi.pl --listen /run/fastcgi/ngcp-panel.sock --pidfile /run/fastcgi/ngcp-panel.pid --nproc $NPROC
 
+# Service cannot create writable executable memory mappings that are writable and executable at the same time
+MemoryDenyWriteExecute=true
+
 # Files + directories not directly associated are made invisible in the /proc/ file system
 # ProcSubset=pid
 # Disabled: MT#58964, to be able to read /proc/ngcp/flags/
@@ -24,30 +27,56 @@ ExecStart=/usr/share/ngcp-panel/ngcp_panel_fastcgi.pl --listen /run/fastcgi/ngcp
 # ProtectProc=invisible
 # Disabled: MT#58964, to be able to read /proc/ngcp/flags/
 
+# Writes to the hardware clock or system clock will be denied
+ProtectClock=true
+
 # Service cannot modify the control group file system (via /sys/fs/cgroup)
 ProtectControlGroups=true
 
 # Service has no access to home directories
 ProtectHome=true
 
+# Set up new UTS namespace for the executed processes + changing hostname or domainname is prevented
+ProtectHostname=true
+
+# Service cannot load or read kernel modules
+ProtectKernelModules=true
+
+# Service cannot alter kernel tunables (/proc + /sys)
+ProtectKernelTunables=true
+
+# Service has strict read-only access to the OS file hierarchy
+ProtectSystem=strict
+
+# Access to the kernel log ring buffer will be denied
+ProtectKernelLogs=true
+
+# Service may execute system calls only with native ABI
+SystemCallArchitectures=native
+
+# Limit set of capabilities
+CapabilityBoundingSet=
+
 # Service process does not receive ambient capabilities
 AmbientCapabilities=
 
 # Service has no access to other software's temporary files
 PrivateTmp=true
 
-# Service has strict read-only access to the OS file hierarchy
-ProtectSystem=strict
+# Service has no access to hardware devices
+PrivateDevices=true
 
 # Limit write access
 # NOTE: we need r/w access to ngcp-panel/Catalyst tmp folder
 ReadWritePaths=/ngcp-data/tmp/www-data/
 # NOTE: we need r/w access to /ngcp-data/spool/faxserver for sending fax
 ReadWritePaths=-/ngcp-data/spool/faxserver
-# NOTE: we need r/w access for sendmail usage with exim
-ReadWritePaths=-/var/spool/exim4/
-ReadWritePaths=-/var/log/exim4/
-ReadWritePaths=-/var/mail/
+
+# Service cannot change ABI personality
+LockPersonality=true
+
+# Turn off acquisition of new privileges system-wide
+NoNewPrivileges=true
 
 # Service has own user namespace, only root, nobody, and the uid/gid under which the service is running are mapped
 # NOTE: we can't have our own user namespace, as we need proper permissions e.g. to /ngcp-data/spool/faxserver
@@ -57,6 +86,18 @@ PrivateUsers=false
 # NOTE: service runs as root, so option does not matter
 RemoveIPC=true
 
+# Restrict service to allocation of local, ipv4 + ipv6 sockets
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+# Restrict access to the various process namespace types the Linux kernel provides
+RestrictNamespaces=true
+
+# Service may not acquire realtime scheduling
+RestrictRealtime=true
+
+# Attempts to set SUID or SGID bits on files or directories will be denied
+RestrictSUIDSGID=true
+
 # Files created by service are accessible only by service's own user by default
 UMask=0077
 
@@ -72,36 +113,14 @@ IPAddressAllow=any
 # Maximum number of bytes of memory that may be locked into RAM
 LimitMEMLOCK=0
 
-# NOTE: we need to allow acquisition of new privileges, otherwise sendmail fails to work
-NoNewPrivileges=false
-
-# {{{
-# NOTE: all of the following hardenings need to stay disabled, as long as we use the
-# sendmail(1) interface via perl's Email::Sender::Transport::Sendmail library
-#CapabilityBoundingSet=
-#LockPersonality=true
-#MemoryDenyWriteExecute=true
-#PrivateDevices=true
-#ProtectClock=true
-#ProtectHostname=true
-#ProtectKernelLogs=true
-#ProtectKernelModules=true
-#ProtectKernelTunables=true
-#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
-#RestrictNamespaces=true
-#RestrictRealtime=true
-#RestrictSUIDSGID=true
-#SystemCallArchitectures=native
-
 # Restrict system calls that are allowed to be executed
 # NOTE: @system-service => reasonable set of system calls used by common system services
-#SystemCallFilter=@system-service
+SystemCallFilter=@system-service
 # NOTE: return with ENOSYS instead of terminating the process immediately
-#SystemCallErrorNumber=ENOSYS
+SystemCallErrorNumber=ENOSYS
 
 # All system calls except the listed ones will be logged
-#SystemCallLog=~@system-service seccomp
-# }}}
+SystemCallLog=~@system-service seccomp
 
 [Install]
 WantedBy=multi-user.target