Page 5 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
An endpoint-protection exclusion changes what a control can inspect or block. Require a narrow technical case, accountable owner, compensating measures, test evidence, expiry, monitoring, and verified removal for every exception.
Read the checklist
Unauthenticated scans show an outside view; authenticated checks can inspect local configuration, software, and patch evidence. Use both deliberately, protect scanner credentials, prove successful authentication, and handle fragile systems separately.
Read the guide
Removable media can carry essential recovery data, sensitive records, and malicious content across trust boundaries. Define approved uses, managed media, encryption, scanning, transfer stations, custody, retention, and sanitization by risk.
Read the playbook
An exception without an owner, evidence, compensating control, expiry, and removal plan becomes an undocumented standard. Use a common register, risk-based approval, automatic reminders, verification, and escalation for renewal.
Read the playbook
A generator start test does not prove the facility can carry its required load through an outage. Validate transfer, measured demand, load steps, fuel, cooling, alarms, runtime, dependencies, recovery, and service ownership.
Read the checklist
Utility power returning does not mean every dependent service is ready. Build and rehearse an authorized restart sequence that validates power quality, facility systems, network, identity, storage, applications, security, and monitoring.
Read the playbook
An alternate location is useful only if authorized people can reach it, authenticate, communicate, obtain governed data, perform priority work, and sustain operations. Design and exercise the entire capability, not just the address.
Read the guide
An after-action report creates value only when findings become owned, funded, verified improvements. Preserve evidence, identify root conditions, assign measurable actions, manage risk and dependencies, retest, and require closure proof.
Read the playbook
Water can disable power, communications, access control, video, servers, cabling, and safe building entry at once. Map exposure, protect critical equipment, define isolation and life-safety procedures, preserve evidence, and rehearse recovery.
Read the checklist
Two provider names do not prove two survivable communications paths. Trace building entrances, conduits, central offices, power, customer equipment, upstream facilities, DNS, routing, support, and failover behavior before calling a design diverse.
Read the guide