diff --git a/templates/etc/profile.d/50-umask.sh.j2 b/templates/etc/profile.d/50-umask.sh.j2
new file mode 100644
index 0000000..e300e9c
--- /dev/null
+++ b/templates/etc/profile.d/50-umask.sh.j2
@@ -0,0 +1,7 @@
+## Ansible controlled file
+# Added as part of ansible-lockdown CIS baseline
+# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown
+
+# Set umask with highest precedence
+
+umask 027