Page 2 of the DSE Networks & Infrastructure knowledge center, with source-backed guidance and practical next steps.
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
Current joint guidance prioritizes centralized intended configuration, isolated management, least privilege, secure protocols, protected telemetry, integrity checks, and lifecycle maintenance.
Read the checklistDDoS readiness requires prioritized public services, provider coverage and emergency contacts, observable baselines, upstream mitigation, exercised decisions, and validated recovery.
Read the playbookDNS over HTTPS protects client-to-resolver traffic, but unmanaged external resolvers can bypass enterprise filtering, logging, caching, internal naming, and split-DNS behavior.
Read the explainerNIST frames enterprise patching as planned preventive maintenance: identify, prioritize, acquire, install, verify, and govern updates across their full operating lifecycle.
Read the guideFEMA continuity guidance connects essential functions to authority, people, facilities, communications, vital records, technology, devolution, reconstitution, and recurring exercises.
Read the checklistNIST zero trust architecture removes implicit trust based on network location or ownership and makes access to each resource an explicit identity, device, context, and policy decision.
Read the explainerCISA’s maturity model organizes zero-trust progress across Identity, Devices, Networks, Applications and Workloads, and Data with visibility, automation, and governance spanning each pillar.
Read the guideCurrent joint guidance centers effective logging on approved policy, centralized collection and correlation, protected log integrity, and detections designed for relevant threats.
Read the checklistNIST’s durable log-management structure starts with policy, organization-wide responsibility, infrastructure, operating processes, and supported staff—not a particular analytics product.
Read the guideProtective DNS can apply threat-informed policy to domain lookups, but selection must also address availability, privacy, logging, hybrid coverage, integrations, and traffic that bypasses DNS.
Read the guide