Page 275 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
A baseline is a starting point selected for a defined context. Record every scoping, parameter, addition, removal, replacement, overlay, and compensating decision with its rationale and owner.
Read the guide
The voluntary NIST Privacy Framework helps organizations identify and manage privacy risk. Use a versioned profile to connect data processing, effects on people, priorities, owners, and measured improvement.
Read the explainer
Privacy risk is not limited to unauthorized disclosure. Use a common vocabulary to examine data actions, context, potential effects on individuals, organizational consequences, and system design choices.
Read the guide
OWASP ASVS provides versioned web-application security requirements for verification, development guidance, and procurement. Select applicable requirements and require reproducible evidence against the exact version.
Read the guide
OWASP SAMM organizes software assurance across governance, design, implementation, verification, and operations. Assess current practice, choose a justified target, and improve with observable evidence.
Read the guide
The OWASP API Security Top 10 distinguishes object-level, property-level, and function-level authorization failures. Test each requested resource, field, and operation with representative identities.
Read the checklist
CVSS v4.0 separates Base, Threat, Environmental, and Supplemental metrics. Preserve the vector and enrich provider severity with current threat and environment facts before prioritization.
Read the explainer
EPSS estimates the probability that exploitation activity for a published CVE will be observed in the next 30 days. Combine the dated forecast with applicability, impact, controls, KEV, and direct evidence.
Read the explainer
An AI answer is only as authorized as the retrieval path behind it. Preserve source permissions, evaluate the current user at query time, deny uncertain matches, and test revocation before an assistant searches customer records.
Read the guide
AI memory can improve continuity while retaining sensitive or hostile context beyond the original exchange. Define what may be remembered, its provenance, tenant boundary, expiry, user controls, deletion path, and incident response before enabling persistence.
Read the guide