Page 16 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Windows Server 2016 extended support ends January 12, 2027. An exit plan needs workload ownership, dependency and compatibility evidence, a supported target path, tested recovery, migration proof, and documented retirement—not only an OS count.
Read the playbook
For financial institutions actually covered by the FTC Safeguards Rule, service-provider oversight connects risk-based selection, tailored contract safeguards, ongoing monitoring, periodic reassessment, remediation, and secure exit.
Read the guide
FFIEC's authentication and access guidance is risk-based, not an MFA-only checklist. Covered institutions can translate it into scoped risk decisions, layered preventive, detective, and corrective controls, testing, residual-risk approval, and examination-ready evidence.
Read the playbook
OAuth consent can give an application continuing access to Microsoft 365 data without stealing a password. Govern grants, permissions, ownership, review, and revocation as an identity lifecycle.
Read the playbook
Modern password policy emphasizes length, compromised-password screening, rate limiting, password-manager compatibility, and evidence-based changes while treating account recovery as a separate high-risk control.
Read the guide
A secure mobile program distinguishes company-owned and personal devices, documents privacy boundaries, enrolls management before access, protects business data, and prepares for loss, reassignment, and retirement.
Read the checklist
Business email compromise succeeds when a convincing message can change where money goes. Add independent verification, separation of duties, evidence, and rapid bank-and-IC3 response to the payment process.
Read the playbook
A useful data register follows information through collection, storage, sharing, backup, export, retention, and deletion so the organization can protect what it needs and stop retaining what it does not.
Read the guide
Annual completion is not the same as readiness. A managed learning program uses role-specific objectives, practical exercises, several measures, leadership support, and continuous improvement to change security and privacy behavior.
Read the guide
Agentic AI combines models with tools, data, memory, and planning so it can act without continuous supervision. Limit its identity, privileges, tools, context, autonomy, and blast radius before deployment.
Read the checklist