Page 282 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
A useful penetration test can also interrupt services, expose data, or resemble a real attack. Written rules of engagement turn scope, permission, safety boundaries, communications, evidence handling, and stop authority into testable controls.
Read the checklist
Identity proofing establishes which real-world person is being enrolled; authentication later proves control of an authenticator. Select the needed assurance, protect proofing data, offer workable paths, and build redress for mistakes and fraud.
Read the guide
Continuous monitoring does not mean collecting every signal in real time. Choose what to observe and how often from risk, volatility, control importance, and decision needs; then route meaningful change to an accountable response.
Read the guide
A policy, screenshot, or enabled setting proves only part of a control. Build assessment procedures around what must be examined, interviewed, and tested, then record whether implementation is correct, operating as intended, and producing the required outcome.
Read the playbook
Security impact is not a single generic rating. Evaluate confidentiality, integrity, and availability separately, document the consequences of loss, then use the high-water mark without losing the underlying distinctions.
Read the guide
Cyber resilience is an engineered ability to continue mission-essential outcomes through attack and compromise—not a synonym for prevention or backup. Define what must endure, then design and test for anticipation, resistance, recovery, and adaptation.
Read the guide
A 911 call from a desk, lobby, elevator landing, guard post, or conference room should connect without a prefix, carry usable dispatchable location, alert the right onsite responder, and survive moves and changes.
Read the playbook
A certified safe room can fail operationally when it is locked, used for storage, missing from the warning plan, over capacity, poorly signed, inaccessible, or not maintained as its approved design requires.
Read the checklist
Alarm coverage is not inclusive when a signal depends on one sense, cannot be perceived in the occupied space, is confused with another warning, or leaves no accessible way to understand and act.
Read the guide
Welding, cutting, brazing, grinding, and other spark- or heat-producing work need one controlled lifecycle: choose a safe location, remove or shield hazards, authorize the work, protect openings, watch for fire, and close the permit only after the area remains safe.
Read the playbook