Page 276 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
A chat transcript cannot prove which identity, permission, tool, parameters, approval, or downstream result produced a business change. Build a protected event chain around every AI tool invocation while keeping secrets and sensitive content out of routine telemetry.
Read the playbook
An MCP server can expose data and executable tools to an AI client. Inventory the publisher, code, tool definitions, identities, token audiences, network destinations, versions, changes, logs, and revocation path before allowing production use.
Read the checklist
An AI agent must not decide for itself whether its next action needs human review. Define consequential actions in policy and code, present the exact proposed effect, issue narrow expiring approval, detect compound actions, and preserve an accountable record.
Read the playbook
Microsoft GDAP can narrow a partner’s access by role and duration. An MSP still needs task-based role design, controlled group membership, customer approval, monitoring, renewal, and a tested emergency path.
Read the playbook
An MSP identity exposed to ordinary email and browsing can become a route into customer administration. Separate privileged operators, devices, policies, secrets, and monitoring from collaboration activity.
Read the guide
Disabling one directory account does not end an MSP technician’s access. Close sessions, groups, RMM and PSA accounts, vault permissions, customer-local identities, API tokens, recovery paths, and shared knowledge.
Read the checklist
PSA, RMM, identity, security, backup, and billing systems answer different questions. Reconcile them so unmanaged assets, stale agents, unknown identities, licensing gaps, and contract mismatches become owned work.
Read the playbook
Configuration drift can reveal errors, emergency changes, failed deployment, legitimate exceptions, or compromise. Normalize the evidence, classify impact, assign ownership, and require controlled remediation.
Read the playbook
DNSSEC validation can authenticate signed DNS data and detect certain tampering, but it does not encrypt queries or certify that a destination is safe. Deploy it with measured resolver tests and failure handling.
Read the guide
A copied running configuration is not yet a recovery capability. Prove that hardware, firmware, licensing, identity, certificates, secrets, dependencies, telemetry, and business traffic can be restored together.
Read the checklist