Operational Security Checklist
==============================

Use this checklist to validate complete implementation of the
Control-Plane Security Onion.

Outer Layer
-----------

☐ Management interface isolated to dedicated network

☐ TMUI access restricted to approved source IP ranges

☐ Self IP Port Lockdown configured (Allow Custom on data VLANs)

☐ SSH access restricted to approved source IP ranges

☐ Firewall rules prevent internet exposure of control-plane services

☐ SNMP restricted to authorized monitoring systems

Middle Layer
------------

☐ Centralized AAA integration configured

☐ Role mapping verified

☐ MFA enforced for administrative access

☐ TLS 1.0 and 1.1 disabled

☐ Weak cipher suites removed

☐ API access restricted and monitored

Core Layer
----------

☐ RBAC roles defined and reviewed

☐ Unused accounts removed

☐ Appliance mode evaluated and enabled if appropriate

☐ Secrets protected (HSM or SecureVault as applicable)

☐ Break-glass account secured and tested

☐ Control-plane logs forwarded to SIEM

☐ Configuration backup automation verified

Validation
----------

☐ iHealth QKView uploaded

☐ No high-risk control-plane findings remain

☐ HA and ConfigSync verified functional

☐ Incident response procedures documented


This checklist should be reviewed quarterly or after major configuration changes.