Page 16 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
NIST NCCoE treats TLS server certificates as an enterprise operating program: policy, discovery, ownership, controlled issuance, key protection, automation, monitoring, emergency replacement, and auditable evidence.
Read the guide
ScubaGear can compare Microsoft 365 configuration with CISA's SCuBA baselines. A defensible program also controls permissions, versions, configuration, exceptions, evidence, remediation, reruns, and drift interpretation.
Read the playbook
Managed identities, service principals, and user-based service accounts can retain access without human visibility. Choose the safest type, record ownership and purpose, control permissions and credentials, monitor use, and retire dependencies safely.
Read the guide
As of August 4, 2026, Windows 10 ESU Year 2 planning requires an edition-and-version inventory. Commercial 22H2 ESU is annual and cumulative; LTSC and LTSB releases follow separate lifecycles and must not be grouped with 22H2.
Read the guide
Windows Server 2016 extended support ends January 12, 2027. An exit plan needs workload ownership, dependency and compatibility evidence, a supported target path, tested recovery, migration proof, and documented retirement—not only an OS count.
Read the playbook
For financial institutions actually covered by the FTC Safeguards Rule, service-provider oversight connects risk-based selection, tailored contract safeguards, ongoing monitoring, periodic reassessment, remediation, and secure exit.
Read the guide
FFIEC's authentication and access guidance is risk-based, not an MFA-only checklist. Covered institutions can translate it into scoped risk decisions, layered preventive, detective, and corrective controls, testing, residual-risk approval, and examination-ready evidence.
Read the playbook
OAuth consent can give an application continuing access to Microsoft 365 data without stealing a password. Govern grants, permissions, ownership, review, and revocation as an identity lifecycle.
Read the playbook
Modern password policy emphasizes length, compromised-password screening, rate limiting, password-manager compatibility, and evidence-based changes while treating account recovery as a separate high-risk control.
Read the guide
Microsoft 365 resiliency, native deleted-item recovery, Purview retention, and Microsoft 365 Backup solve different problems. Map the available mechanism, protect its administration, and prove recovery with realistic tests.
Read the playbook