Page 211 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
NIST IR 8286D says business impact analysis can extend beyond availability to the mission impact of any type of loss. The described process links mission objectives to enabling assets, criticality and sensitivity factors, and risk prioritization and response.
Read the explainer
NIST SP 1800-25 treats devices, data, and applications as assets that can become targets of data-integrity attacks. Its example solution combines asset identification and protection methods including backups, secure storage, integrity checks, logs, and vulnerability management.
Read the guide
NIST SP 800-18 Rev. 2 collectively calls the system security, privacy, and C-SCRM plans 'system plans.'. NIST says those plans describe system purpose, control operational status, and responsibilities and expected behavior of people who manage, support, and access the system.
Read the playbook
NIST IR 8286B describes prioritizing identified cybersecurity risks by their potential impact on enterprise objectives. It describes adding priority and response information to a cybersecurity risk register in support of an enterprise risk register.
Read the briefing
Fire and EMS devolution planning determines the essential minimum service level and how service delivery changes when resources no longer meet community need. The plan should identify trigger points for altering services and separate triggers and phasing for reconstituting those services.
Read the checklist
NIST SP 800-221A provides an outcomes framework intended to apply across types of ICT risk. The source names cybersecurity, privacy, and supply-chain risk as examples and positions the framework as complementary to SP 800-221.
Read the explainer
Before relocation, reconstitution procedures should verify that systems, communications, and other capabilities required for essential functions are operational at the restored or replacement facility.
Read the guide
A delegation of authority should state the circumstances in which delegated authority becomes effective and when it terminates. The instrument should delineate limits and accountability and state whether a successor may redelegate functions and activities.
Read the playbook
DNAME substitution replaces only the whole suffix labels that match the DNAME owner with the labels in the DNAME target. A DNAME redirects names below its owner; unlike a CNAME, it does not redirect the DNAME owner name itself.
Read the briefing
An SRV record identifies a service endpoint with priority, weight, port, and target fields. A client first selects reachable SRV targets with the lowest priority value, then uses weight to choose among targets at that priority.
Read the checklist