DNS policy readiness checklist

• Endpoint DNS enforcement documented in ICT risk register
• No reliance on ISP or public resolver for policy
• UT1 category policy assigned per group
• Tenant allowlist with owner and review date
• Tenant blocklist for sanctioned prohibitions
• Threat feeds with signature verification (ed25519)
• Offline enforcement with last signed bundle
• Local block page shows domain and policy reason
• False-positive review queue with admin SLA
• Block events exportable as CSV or JSON
• Entra SSO for admin console
• Per-device enrollment — no shared agent passwords

Score: 0 / 12