Page 5 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Validate the complete Certification Authority recovery set, including database, private keys, configuration, templates, revocation publishing, and HSM steps.
Read the checklist
Federation moves authentication information between separately administered parties. Document which provider, assertion, attributes, audience, assurance, and failure paths each relying service will accept.
Read the guide
The Secure Software Development Framework supplies a common set of high-level practices. Translate them into owners, workflow gates, artifacts, exceptions, and supplier questions.
Read the playbook
NIST's SSDF community profile adds AI-model-specific considerations to the broader secure-development framework. Include data, model, evaluation, release, integration, and response paths in scope.
Read the guide
Cloud-native zero trust shifts application policy toward user, application, and service identities. Inventory workload identities and enforce narrowly scoped service-to-service authorization across environments.
Read the guide
Containers package applications but depend on a broader system. Govern image origin, build evidence, registry access, runtime policy, host security, monitoring, and retirement as one lifecycle.
Read the checklist
Platform firmware is needed to boot and operate a system. Procurement and operations should address unauthorized change prevention, detection, supported recovery, and evidence of restoration.
Read the guide
NIST's minimum verification guidance describes multiple complementary techniques. Select, scope, and retain evidence from the techniques that address design, code, dependencies, and running behavior.
Read the checklist
IaaS, PaaS, and SaaS expose different components and administrative boundaries. Trace every important access decision to the identity, policy, service layer, owner, and evidence source that enforce it.
Read the guide
OAuth authorization-code flows need exact redirect URI matching and correctly enforced PKCE. Treat both as testable protocol controls across every client and authorization server.
Read the guide