Systemd by itself comes with this wonderful analysis tool.

Systemd-analyze security Systemd-analzye security <service>

There it details what capabilities, and restrictions are in place for a given systemd service. From there you can edit the service to restrict even further as required if you want.