Page 12 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Cloud investigators depend on provider capabilities, customer configuration, jurisdiction, interfaces, time, and retention that cannot be improvised after an incident. Map evidence needs to cloud capabilities and mitigate gaps before collection becomes urgent.
Read the playbook
A useful penetration test can also interrupt services, expose data, or resemble a real attack. Written rules of engagement turn scope, permission, safety boundaries, communications, evidence handling, and stop authority into testable controls.
Read the checklist
Identity proofing establishes which real-world person is being enrolled; authentication later proves control of an authenticator. Select the needed assurance, protect proofing data, offer workable paths, and build redress for mistakes and fraud.
Read the guide
Continuous monitoring does not mean collecting every signal in real time. Choose what to observe and how often from risk, volatility, control importance, and decision needs; then route meaningful change to an accountable response.
Read the guide
A policy, screenshot, or enabled setting proves only part of a control. Build assessment procedures around what must be examined, interviewed, and tested, then record whether implementation is correct, operating as intended, and producing the required outcome.
Read the playbook
Security impact is not a single generic rating. Evaluate confidentiality, integrity, and availability separately, document the consequences of loss, then use the high-water mark without losing the underlying distinctions.
Read the guide
Cyber resilience is an engineered ability to continue mission-essential outcomes through attack and compromise—not a synonym for prevention or backup. Define what must endure, then design and test for anticipation, resistance, recovery, and adaptation.
Read the guide
Windows devices can keep booting after the 2011 Secure Boot certificates expire yet miss future early-boot protections. Inventory status, update OEM firmware, pilot by hardware family, and verify the 2023 trust chain with evidence.
Read the playbook
Microsoft now plans to disable SMTP AUTH Basic authentication by default for existing Exchange Online tenants at the end of December 2026. Find every sender, choose a supported replacement, pilot it, and prove the legacy path is quiet.
Read the playbook
SMB over QUIC protects Windows file access with TLS 1.3 over UDP 443, but Windows clients can still prefer TCP and external authentication can fall back to NTLM. Prove transport, identity, certificates, and renewal before production.
Read the checklist