Page 39 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
A useful cyber tabletop tests who decides, with what evidence, while technology and third parties fail. Build objectives around decisions, inject dependency loss, observe communications, and retest corrective actions.
Read the guide
An alternate chat room is not enough when attackers can monitor normal tools or impersonate responders. Pre-provision independent communications, verify identities through trusted records, and exercise degraded-mode operations.
Read the playbook
Insider risk cannot be managed by surveillance alone. Use multidisciplinary governance, critical-asset controls, narrowly justified monitoring, human review, support pathways, privacy safeguards, and consistent response.
Read the guide
A board dashboard should connect cyber exposure and control evidence to enterprise objectives, risk tolerance, accountable owners, and decisions. Replace unbounded activity counts with trends, denominators, uncertainty, and asks.
Read the guide
Forest recovery is a controlled rebuild of the organization’s identity service. It requires trusted backups, an isolated recovery sequence, privileged credential resets, dependency validation, and rehearsed business acceptance—not simply a restored domain controller.
Read the playbook
Microsoft Entra Connect is replaceable only when its configuration, advanced exceptions, credentials, failover order, and validation evidence are ready. Staging mode lowers recovery time, but it is active-passive—not active-active.
Read the playbook
NIST NCCoE treats TLS server certificates as an enterprise operating program: policy, discovery, ownership, controlled issuance, key protection, automation, monitoring, emergency replacement, and auditable evidence.
Read the guide
ScubaGear can compare Microsoft 365 configuration with CISA's SCuBA baselines. A defensible program also controls permissions, versions, configuration, exceptions, evidence, remediation, reruns, and drift interpretation.
Read the playbook
Managed identities, service principals, and user-based service accounts can retain access without human visibility. Choose the safest type, record ownership and purpose, control permissions and credentials, monitor use, and retire dependencies safely.
Read the guide
As of August 4, 2026, Windows 10 ESU Year 2 planning requires an edition-and-version inventory. Commercial 22H2 ESU is annual and cumulative; LTSC and LTSB releases follow separate lifecycles and must not be grouped with 22H2.
Read the guide