A method for the questionnaire that lands on a Friday: the sections, the precise sentences, and what to say when the honest answer is a limitation.
One trusted network, roaming workforce, isolated management plane: which to choose, what the change request says, what each costs you on a bad day.
A vault that injects a credential into a session must decrypt it. What that means, what it does not, and the three sentences for your questionnaire.
No inbound rule on any endpoint, no VPN, no RDP gateway. What the agent needs, where a port does open, and why the questionnaire gets a short answer.