Page 139 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
OWASP ASVS provides versioned web-application security requirements for verification, development guidance, and procurement. Select applicable requirements and require reproducible evidence against the exact version.
Read the guide
OWASP SAMM organizes software assurance across governance, design, implementation, verification, and operations. Assess current practice, choose a justified target, and improve with observable evidence.
Read the guide
The OWASP API Security Top 10 distinguishes object-level, property-level, and function-level authorization failures. Test each requested resource, field, and operation with representative identities.
Read the checklist
CVSS v4.0 separates Base, Threat, Environmental, and Supplemental metrics. Preserve the vector and enrich provider severity with current threat and environment facts before prioritization.
Read the explainer
EPSS estimates the probability that exploitation activity for a published CVE will be observed in the next 30 days. Combine the dated forecast with applicability, impact, controls, KEV, and direct evidence.
Read the explainer
An AI answer is only as authorized as the retrieval path behind it. Preserve source permissions, evaluate the current user at query time, deny uncertain matches, and test revocation before an assistant searches customer records.
Read the guide
AI memory can improve continuity while retaining sensitive or hostile context beyond the original exchange. Define what may be remembered, its provenance, tenant boundary, expiry, user controls, deletion path, and incident response before enabling persistence.
Read the guide
A chat transcript cannot prove which identity, permission, tool, parameters, approval, or downstream result produced a business change. Build a protected event chain around every AI tool invocation while keeping secrets and sensitive content out of routine telemetry.
Read the playbook
An MCP server can expose data and executable tools to an AI client. Inventory the publisher, code, tool definitions, identities, token audiences, network destinations, versions, changes, logs, and revocation path before allowing production use.
Read the checklist
An AI agent must not decide for itself whether its next action needs human review. Define consequential actions in policy and code, present the exact proposed effect, issue narrow expiring approval, detect compound actions, and preserve an accountable record.
Read the playbook