network-access.xml 1 2027-01-04T08:00:00 08:00:00 17:00:00 480 2400 20 7 1 1 Standard 1 -1 1 0 2 1 08:00:0012:00:00 13:00:0017:00:00 3 1 08:00:0012:00:00 13:00:0017:00:00 4 1 08:00:0012:00:00 13:00:0017:00:00 5 1 08:00:0012:00:00 13:00:0017:00:00 6 1 08:00:0012:00:00 13:00:0017:00:00 7 0 1 1 Phase 0 — Charter, alignment and inventory 1 1

1

2027-01-04T08:00:00 2027-01-26T17:00:00 2 2 N0.1 Naming-plane owner confirmed; pilot population defined; remote-access paths and residual VPN use inventoried 1.1 2 2027-01-04T08:00:00 2027-01-08T17:00:00 PT40H0M0S 7 0 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Source: ../books/b09-network/09-who-owns-the-network.md#the-charters-plan-in-one-table 3 3 N0.2 AD DNS and DHCP inventory, read-only, committed as JSON; DnsAdmins emptied of non-domain-administrators 1.2 2 2027-01-04T08:00:00 2027-01-15T17:00:00 PT80H0M0S 7 0 AD administrators Owner or approver: AD administrators Source: ../books/b08-ddi/10-migration-sequence.md#phase-1-inventory-and-baseline 4 4 N0.3 DDI candidates scored on evidence: Marketplace status, policy-plane coverage, the five decisions, vendor questions in writing 1.3 2 2027-01-11T08:00:00 2027-01-26T17:00:00 PT96H0M0S 7 0 DNS/DDI team Owner or approver: DNS/DDI team Source: ../books/b08-ddi/12-selection-cost-and-residual-risk.md#selection-criteria 2 1 0 7 5 5 D-N1 DDI platform model 1.4 2 2027-01-26T17:00:00 2027-01-26T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Options: SaaS policy plane; agency-operated DDI inside the boundary; cloud-native services managed as code (enough on its own for a single-cloud agency with no divisional delegation) If decided late: Coexistence can't be deployed, and the pilot division's DNS move (program P2.6) has nothing to move onto Source: ../books/b08-ddi/12-selection-cost-and-residual-risk.md#comparing-the-platform-models 4 1 0 7 6 6 NG0 Gate 0 — Inventory committed and decisions owned 1.5 2 2027-01-26T17:00:00 2027-01-26T17:00:00 PT0H0M0S 7 1 DNS/DDI team Owner or approver: DNS/DDI team Criteria: AD DNS inventory dated, committed and reviewed (Decision 4); every branch's redirect-dns target read from the running configuration; platform model decided; one named decider for every row of the DNS and network matrices Source: ../books/b08-ddi/08-reference-architecture.md#decision-4-ad-dns-inventory-before-retirement 3 1 0 7 5 1 0 7 7 7 Phase 1 — Naming and addressing 2 1

1

2027-01-27T08:00:00 2027-08-13T17:00:00 8 8 X-P17 Cloud DNS Private Resolver deployed (program P1.7) 2.1 2 2027-02-12T17:00:00 2027-02-12T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: Coexistence has no cloud resolver to forward to, and Phase 1 waits Source: program-master-schedule.md 4 2027-02-12T17:00:00 9 9 N1.1 Coexistence: DDI resolvers deployed, Microsoft DNS and DHCP synchronized read-only, forwarding both ways with one path per namespace 2.2 2 2027-02-15T08:00:00 2027-02-24T17:00:00 PT64H0M0S 7 0 DNS/DDI team Owner or approver: DNS/DDI team Source: ../books/b08-ddi/10-migration-sequence.md#phase-2-deploy-coexistence 6 1 0 7 8 1 0 7 10 10 X-P26S Program starts the pilot division's DNS move (start of P2.6) 2.3 2 2027-02-26T17:00:00 2027-02-26T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The pilot division's zones and scopes have no coexistence to move through, and the program's pilot slips Source: program-master-schedule.md 4 2027-02-26T17:00:00 9 1 0 7 11 11 D-N2 Resolver path: the redirect-dns target and the forwarding chain order (Decisions 1 and 2) 2.4 2 2027-01-26T17:00:00 2027-01-26T17:00:00 PT0H0M0S 7 1 DNS/DDI team Owner or approver: DNS/DDI team Options: A DDI resolver at the branch; a forwarding proxy in a regional hub. Never a client loopback stub, and any SASE resolver is a forwarding target of the agency resolver, never the redirect target If decided late: Branch edges can't be retargeted; Protective DNS, logging and response policy stay off the branch path Source: ../books/b08-ddi/08-reference-architecture.md#decision-1-the-redirect-dns-destination 6 1 0 7 12 12 N1.2 Edge retargeted: redirect-dns to agency resolvers, SASE DNS as a forwarding target, order verified in the running configuration 2.5 2 2027-02-25T08:00:00 2027-03-10T17:00:00 PT80H0M0S 7 0 Network engineering Owner or approver: Network engineering Source: ../books/b08-ddi/10-migration-sequence.md#retargeting-the-edge 11 1 0 7 9 1 0 7 13 13 D-N3 Order of zones to move, and the cutover pattern for each 2.6 2 2027-02-24T17:00:00 2027-02-24T17:00:00 PT0H0M0S 7 1 DNS/DDI team Owner or approver: DNS/DDI team Options: Per zone: split horizon, subdomain delegation, or progressive migration with conditional forwarding. AD locator records stay where domain controllers can register them, and move last If decided late: Authority can't move zone by zone; the pilot division's zones wait Source: ../books/b08-ddi/10-migration-sequence.md#three-cutover-patterns 9 1 0 7 14 14 X-P26 Pilot division's DNS migrated and DHCP re-homed (program P2.6) 2.7 2 2027-03-19T17:00:00 2027-03-19T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The cutover loop hasn't been proven on a division, so the remaining zone moves wait Source: program-master-schedule.md 4 2027-03-19T17:00:00 15 15 N1.3 Non-AD zones, forwarders, GlobalNames and reverse zones moved through the cutover loop 2.8 2 2027-03-22T08:00:00 2027-04-09T17:00:00 PT120H0M0S 7 0 DNS/DDI team Owner or approver: DNS/DDI team Source: ../books/b08-ddi/10-migration-sequence.md#zones-and-records 13 1 0 7 14 1 0 7 16 16 N1.4 Clients and DHCP scopes moved in waves with the program's divisions (option 6, VNet DNS settings) 2.9 2 2027-04-12T08:00:00 2027-08-13T17:00:00 PT720H0M0S 7 0 DNS/DDI team Owner or approver: DNS/DDI team Source: ../books/b08-ddi/10-migration-sequence.md#moving-clients-in-waves 15 1 0 7 17 17 N1.5 Cloud federation: IPAM federation, private endpoint zones published once, validation matrix run from every origin 2.10 2 2027-04-12T08:00:00 2027-04-30T17:00:00 PT120H0M0S 7 0 Cloud platform teams Owner or approver: Cloud platform teams Source: ../books/b08-ddi/10-migration-sequence.md#phase-4-cloud-federation 15 1 0 7 18 18 NG1 Gate 1 — Naming plane authoritative for the pilot scope 2.11 2 2027-04-30T17:00:00 2027-04-30T17:00:00 PT0H0M0S 7 1 DNS/DDI team Owner or approver: DNS/DDI team Criteria: Every name class in the validation matrix resolves correctly from on-premises, each cloud and the branch path; no private endpoint name returns a public address; OCSP and CRL endpoints resolve from every origin; every branch's redirect-dns target is an agency resolver; resolution-path consistency baselined Source: ../books/b08-ddi/10-migration-sequence.md#phase-4-cloud-federation 12 1 0 7 17 1 0 7 19 19 Phase 2 — Securing the governor 3 1

1

2027-01-11T08:00:00 2027-04-09T17:00:00 20 20 D-N4 Control-plane hosting model, recorded as the boundary disposition 3.1 2 2027-01-26T17:00:00 2027-01-26T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Options: An on-premises control plane; Cisco Catalyst SD-WAN for Government, cloud-hosted and FedRAMP Certified at Class C (Moderate). A hosted controller doesn't remove the directive's obligations If decided late: The control plane can't be built or hardened, and the pilot waits Source: ../books/b09-network/11-field-office-wan-transformation.md#risks-and-mitigations 6 1 0 7 21 21 N2.1 Control plane built and taken through the ED 26-03 sequence: inventory, off-box logs, patch, hunt, harden, syslog to CISA through CLAW 3.2 2 2027-01-27T08:00:00 2027-03-02T17:00:00 PT200H0M0S 7 0 Network engineering Owner or approver: Network engineering Source: ../books/b09-network/05-sd-wan-sase-and-governed-transport.md#securing-the-controller-and-the-edges 20 1 0 7 22 22 N2.2 Pilot circuits bought on measured physics: per-site latency and loss recorded, diversity, static addressing confirmed with carriers 3.3 2 2027-01-27T08:00:00 2027-02-23T17:00:00 PT160H0M0S 7 0 Network engineering Owner or approver: Network engineering Source: ../books/b09-network/13-sequencing-cost-and-evidence.md#the-decision-sequence 6 1 0 7 23 23 N2.3 Boundary change and branch use-case package prepared as a significant change, with the evidence the authorization package needs 3.4 2 2027-01-11T08:00:00 2027-04-09T17:00:00 PT520H0M0S 7 0 System owner Owner or approver: System owner Source: ../books/b09-network/13-sequencing-cost-and-evidence.md#evidence-for-the-boundary-change 2 1 0 7 24 24 NG2 Gate 2 — Governor secured before it carries traffic 3.5 2 2027-03-02T17:00:00 2027-03-02T17:00:00 PT0H0M0S 7 1 CISO and ISSO Owner or approver: CISO and ISSO Criteria: Controller and edges under vulnerability management on BOD 26-04 windows, privileged-access control and off-box logging; every edge in the fleet inventory with its software version and support date; an ED 26-03-style inventory, log collection and patch sequence executable within a day; SD-WAN syslog reaching CISA through CLAW Source: ../books/b09-network/08-reference-architecture.md#decision-4-bring-the-governor-under-control-before-it-carries-traffic 21 1 0 7 25 25 Phase 3 — Identity-driven access pilot 4 1

1

2027-01-11T08:00:00 2027-06-01T17:00:00 26 26 N3.1 Identity claims reachable by every access decision point; gaps listed 4.1 2 2027-01-27T08:00:00 2027-02-02T17:00:00 PT40H0M0S 7 0 Identity engineering Owner or approver: Identity engineering Source: ../books/b09-network/09-who-owns-the-network.md#the-charters-plan-in-one-table 6 1 0 7 27 27 N3.2 Application-to-path routing policy (the SC-7(4) traffic-flow policy), site register and architecture review determination 4.2 2 2027-02-24T08:00:00 2027-03-09T17:00:00 PT80H0M0S 7 0 System owner Owner or approver: System owner Source: ../books/b09-network/12-microsoft-365-traffic.md#the-three-instruments 22 1 0 7 28 28 D-N5 Egress pattern for each pilot site 4.3 2 2027-02-23T17:00:00 2027-02-23T17:00:00 PT0H0M0S 7 1 Network engineering Owner or approver: Network engineering Options: A, hairpin; C, governed local breakout (the program's reference pattern); D, agent-delivered SASE. Never B, bare local breakout If decided late: Pilot sites can't be built, and the boundary change can't name its enforcement points Source: ../books/b09-network/08-reference-architecture.md#decision-3-choose-the-egress-pattern-per-site-and-change-the-boundary-first 22 1 0 7 29 29 D-N6 Path to a domain controller for each branch class 4.4 2 2027-01-08T17:00:00 2027-01-08T17:00:00 PT0H0M0S 7 1 Network engineering Owner or approver: Network engineering Options: A private path (MPLS, IPsec or the SD-WAN overlay); a ZTNA connector that publishes the domain controllers (single sign-on only); a Kerberos KDC proxy If decided late: Pilot branches on local breakout lose sign-in, Group Policy and password change while cloud applications keep working Source: ../books/b09-network/06-legacy-protocols-on-re-routed-paths.md#ways-to-provide-the-path 2 1 0 7 30 30 N3.3 Ten pilot sites built: edges, regional breakout, security service edge, deterministic egress, a monitored path to a domain controller 4.5 2 2027-03-03T08:00:00 2027-04-06T17:00:00 PT200H0M0S 7 0 Network engineering Owner or approver: Network engineering Source: ../books/b09-network/11-field-office-wan-transformation.md#implementation-roadmap 24 1 0 7 28 1 0 7 29 1 0 7 26 1 0 7 31 31 D-N7 Boundary change for local egress, decided before the first production cutover 4.6 2 2027-04-09T17:00:00 2027-04-09T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Options: Approve the significant change through reauthorization or ongoing authorization; refuse, and the sites stay on their current path If decided late: No production cutover can start: the boundary change comes first Source: ../books/b09-network/13-sequencing-cost-and-evidence.md#the-decision-sequence 23 1 0 7 27 1 0 7 28 1 0 7 32 32 D-N8 Microsoft 365 Optimize exemption (the SC-7(4) traffic-flow exception) 4.7 2 2027-03-09T17:00:00 2027-03-09T17:00:00 PT0H0M0S 7 1 Authorizing official Owner or approver: Authorizing official Options: Grant it for a stated duration and review cadence, on named and compensating controls; refuse it If decided late: Optimize traffic stays on the inspected path at the pilot sites, and the cutover waits Source: ../books/b09-network/12-microsoft-365-traffic.md#the-sc-74-documented-traffic-flow-exception 27 1 0 7 33 33 D-N9 Fabric go-live, site by site: governor live, inspecting and logging 4.8 2 2027-04-30T17:00:00 2027-04-30T17:00:00 PT0H0M0S 7 1 System owner Owner or approver: System owner Options: Turn on the site's new egress; hold the site on its current path If decided late: Pilot traffic stays on the old path, and the 30-day stability clock doesn't start Source: ../books/b09-network/09-who-owns-the-network.md#an-owner-for-each-step 30 1 0 7 31 1 0 7 18 1 0 7 24 1 0 7 34 34 N3.4 Pilot cutover; 30 stable days; CISA telemetry parity confirmed per site; one path decision emitted as a claim 4.9 2 2027-05-03T08:00:00 2027-06-01T17:00:00 PT176H0M0S 7 0 Network engineering Owner or approver: Network engineering Source: ../books/b09-network/05-sd-wan-sase-and-governed-transport.md#the-evidence-the-fabric-must-emit 33 1 0 7 32 1 0 7 35 35 NG3 Gate 3 — Pilot governed and evidenced 4.10 2 2027-06-01T17:00:00 2027-06-01T17:00:00 PT0H0M0S 7 1 CISO Owner or approver: CISO Criteria: Pilot sites stable for 30 days with the control layer live, inspecting and logging to the SIEM; boundary change decided before cutover; SC-7(4) memo signed and site register current; CISA telemetry parity confirmed per site before any legacy circuit ends; one path decision emitted as a claim; the VPN path documented as residual Source: ../books/b09-network/09-who-owns-the-network.md#an-owner-for-each-step 34 1 0 7 36 36 Phase 4 — Customer-edge enforcement 5 1

1

2027-01-11T08:00:00 2027-09-10T17:00:00 37 37 D-N10 RADIUS and NAC platform, and the trigger that retires NPS (D3) 5.1 2 2027-01-08T17:00:00 2027-01-08T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Options: NPS through the hybrid-joined phase only; an on-premises NAC platform reading Intune compliance; a cloud-delivered NAC or RADIUS service with the right FedRAMP authorization; VPN or ZTNA federated to Entra ID for remote access If decided late: Enforcement can't be designed, and Entra-joined devices can't be admitted before cloud-native cutover removes the AD objects NPS relies on Source: ../books/b09-network/07-network-access-control.md#what-can-replace-it 2 1 0 7 38 38 X-P27 Cloud PKI certificates issued; Wi-Fi and VPN verified (program P2.7) 5.2 2 2027-04-09T17:00:00 2027-04-09T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: Monitor mode has no device certificates to authenticate, and the NAC rollout waits Source: program-master-schedule.md 4 2027-04-09T17:00:00 39 39 N4.1 NAC platform registered for Intune compliance retrieval; policy tiers built; monitor mode on pilot ports with a baseline report 5.3 2 2027-04-12T08:00:00 2027-05-21T17:00:00 PT240H0M0S 7 0 Network engineering Owner or approver: Network engineering Source: ../books/b09-network/07-network-access-control.md#posture-comes-from-intune-not-from-a-probe 37 1 0 7 38 1 0 7 40 40 D-N11 Move the pilot sites from monitor mode to wired enforcement 5.4 2 2027-05-21T17:00:00 2027-05-21T17:00:00 PT0H0M0S 7 1 Network engineering Owner or approver: Network engineering Options: Enforce on workstation ports; stay in monitor mode until the baseline's exceptions are closed If decided late: Wired and wireless enforcement wait, and devices are still admitted before they authenticate Source: ../books/b09-network/07-network-access-control.md#rolling-it-out 39 1 0 7 41 41 N4.2 Wired enforcement: open mode removed, CoA tested, captive portal up, IoT devices registered in IPAM, detections routed to the SOC 5.5 2 2027-05-24T08:00:00 2027-07-02T17:00:00 PT240H0M0S 7 0 Network engineering Owner or approver: Network engineering Source: ../books/b09-network/07-network-access-control.md#rolling-it-out 40 1 0 7 42 42 N4.3 Wireless enforcement on WPA3-Enterprise, then IoT segmentation and a rogue-device tabletop 5.6 2 2027-07-05T08:00:00 2027-09-10T17:00:00 PT400H0M0S 7 0 Network engineering Owner or approver: Network engineering Source: ../books/b09-network/07-network-access-control.md#rolling-it-out 41 1 0 7 43 43 NG4 Gate 4 — Customer edge enforced for the pilot 5.7 2 2027-09-10T17:00:00 2027-09-10T17:00:00 PT0H0M0S 7 1 CISO and ISSO Owner or approver: CISO and ISSO Criteria: Monitor-mode baseline report filed; wired and wireless enforcement live at the pilot sites; the three minimum detections alerting the SOC; RADIUS accounting, Intune compliance reports and DHCP audit logs kept for assessors; every MAB exception dated Source: ../books/b09-network/07-network-access-control.md#inventory-profiling-and-logs 42 1 0 7 44 44 Phase 5 — AD DNS and DHCP decommission 6 1

1

2027-08-16T08:00:00 2027-11-16T17:00:00 45 45 X-P43 AD-integrated zones moved, except the domain's own (program P4.3) 6.1 2 2027-10-01T17:00:00 2027-10-01T17:00:00 PT0H0M0S 7 1 Platform teams (program) Owner or approver: Platform teams (program) If decided late: The 30-day SRV hold and the decommission gates can't start Source: program-master-schedule.md 4 2027-10-01T17:00:00 46 46 N5.1 SRV hold: every critical locator record resolves from every VNet and site, every 15 minutes, for 30 clean days 6.2 2 2027-10-04T08:00:00 2027-11-02T17:00:00 PT176H0M0S 7 0 DNS/DDI team Owner or approver: DNS/DDI team Source: ../books/b08-ddi/11-operating-the-control-plane.md#srv-record-monitoring 45 1 0 7 47 47 N5.2 Inventory reconciled both ways; failover tested on the new resolvers and DHCP; query logs show the old servers idle 6.3 2 2027-10-04T08:00:00 2027-10-13T17:00:00 PT64H0M0S 7 0 DNS/DDI team Owner or approver: DNS/DDI team Source: ../books/b08-ddi/10-migration-sequence.md#phase-5-decommission-ad-dns-and-dhcp 45 1 0 7 16 1 0 7 48 48 N5.3 Hardening: Protective DNS forwarding, encrypted DNS, DNSSEC signing and validation where required, monitoring dashboards 6.4 2 2027-08-16T08:00:00 2027-09-03T17:00:00 PT120H0M0S 7 0 DNS/DDI team Owner or approver: DNS/DDI team Source: ../books/b08-ddi/10-migration-sequence.md#phase-6-policy-and-compliance-hardening 16 1 0 7 49 49 D-N12 Decommission AD DNS and Windows DHCP 6.5 2 2027-11-02T17:00:00 2027-11-02T17:00:00 PT0H0M0S 7 1 Executive sponsor and CIO Owner or approver: Executive sponsor and CIO Options: Decommission once all five gates pass, including 90 days of parallel operation; hold the legacy servers. Never on a date alone If decided late: Legacy DNS servers and their DnsAdmins exposure stay in service into the program's AD retirement phase Source: ../books/b08-ddi/10-migration-sequence.md#phase-5-decommission-ad-dns-and-dhcp 46 1 0 7 47 1 0 7 50 50 N5.4 Legacy DNS servers and Windows DHCP servers retired in order, DHCP de-authorized last; exports archived; records officer confirms disposition; 7-day burn-in 6.6 2 2027-11-03T08:00:00 2027-11-16T17:00:00 PT80H0M0S 7 0 AD administrators Owner or approver: AD administrators Source: ../books/b08-ddi/10-migration-sequence.md#phase-5-decommission-ad-dns-and-dhcp 49 1 0 7 51 51 NG5 Gate 5 — Legacy name services retired, evidence complete 6.7 2 2027-11-16T17:00:00 2027-11-16T17:00:00 PT0H0M0S 7 1 DNS/DDI team Owner or approver: DNS/DDI team Criteria: Gates 3 and 4 passed; Chapter 11's evidence checklist complete, the five decisions checked first; no client impact through the burn-in; logs searchable for six months and retrievable for a year; DnsAdmins and delegated roles reviewed; only the domain's own zones left on AD DNS, reached by forwarding, until the last domain controllers go Source: ../books/b08-ddi/11-operating-the-control-plane.md#sample-evidence-checklist 48 1 0 7 50 1 0 7 35 1 0 7 43 1 0 7