Page 181 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
An SBOM is useful only when it is linked to deployed products, checked for freshness, enriched with vulnerability and exploit evidence, and converted into an owned exposure decision or a precise supplier question.
Read the playbook
Application allowlisting can stop unauthorized code, but rushed enforcement can stop the business too. Discover real execution paths, learn in audit mode, pilot by cohort, and govern exceptions, updates, rollback, and recovery.
Read the playbook
A useful cyber tabletop tests who decides, with what evidence, while technology and third parties fail. Build objectives around decisions, inject dependency loss, observe communications, and retest corrective actions.
Read the guide
An alternate chat room is not enough when attackers can monitor normal tools or impersonate responders. Pre-provision independent communications, verify identities through trusted records, and exercise degraded-mode operations.
Read the playbook
Synthetic voice and video can make an impostor look familiar. Remove media familiarity from help-desk resets, executive requests, and payment approvals; verify through independent identity and workflow controls.
Read the checklist
Insider risk cannot be managed by surveillance alone. Use multidisciplinary governance, critical-asset controls, narrowly justified monitoring, human review, support pathways, privacy safeguards, and consistent response.
Read the guide
A board dashboard should connect cyber exposure and control evidence to enterprise objectives, risk tolerance, accountable owners, and decisions. Replace unbounded activity counts with trends, denominators, uncertainty, and asks.
Read the guide
Forest recovery is a controlled rebuild of the organization’s identity service. It requires trusted backups, an isolated recovery sequence, privileged credential resets, dependency validation, and rehearsed business acceptance—not simply a restored domain controller.
Read the playbook
NIST NCCoE treats TLS server certificates as an enterprise operating program: policy, discovery, ownership, controlled issuance, key protection, automation, monitoring, emergency replacement, and auditable evidence.
Read the guide
ScubaGear can compare Microsoft 365 configuration with CISA's SCuBA baselines. A defensible program also controls permissions, versions, configuration, exceptions, evidence, remediation, reruns, and drift interpretation.
Read the playbook