Practical technology guides for work that has to survive implementation.
Use these guides when a briefing is not enough. The maintained library focuses on durable implementation work across AI, security, infrastructure, software delivery, data, governance, compliance, and policy operations.
Library reviewed October 1, 2026. High-change guidance is listed only when current-source review supports presenting it as maintained. For consequential decisions, verify the cited authority and effective date before acting.
Eighty-seven implementation guides, organized around the work.
Each listed guide has an explicit editorial owner, source set, review date, and freshness expectation. Material that does not meet the maintained-library standard is not promoted here.
Artificial Intelligence
Build governance, procurement, evaluation, incident, and workforce practices around evidence rather than vendor momentum.
UK AISI Pre-Deployment Evaluations
Understand collaborative pre-release testing, risk-based model selection, evaluation methods, and why AISI testing is not a blanket statutory deployment approval.
Open guide NIST Generative AI riskNIST AI 600-1 Generative AI Profile
Operationalize confabulation, all 12 NIST GAI risk categories, 200+ suggested actions, and Govern-Map-Measure-Manage evidence without misdating the 2024 publication.
Open guide Azure AI historyAzure OpenAI General Availability (2023)
Separate Microsoft's January 2023 launch milestone from current Microsoft Foundry model, API, deployment, and governance decisions.
Open guide Operating modelAI Governance Implementation
Connect AI inventory, ownership, evidence, evaluation, suppliers, incidents, transparency, and change control.
Open guide ProcurementAI Procurement Governance
Evaluate AI suppliers with current acquisition guidance, evidence requests, contract controls, monitoring, and exit readiness.
Open guide EvaluationAI Model Evaluation Operations
Build reproducible, workload-specific evaluation evidence and model-change gates without confusing vendor benchmarks with buyer findings.
Open guide ResilienceAI Incident Response
Coordinate containment, evidence, classification, suppliers, recovery, and jurisdiction-specific reporting without inventing a universal deadline.
Open guide WorkforceAI Workforce Enablement
Use role-based literacy, practical exercises, safe-use boundaries, capability evidence, and change-triggered refresh.
Open guideCybersecurity
HHS Healthcare Cybersecurity Performance Goals
Implement the 10 essential and 10 enhanced voluntary HPH CPGs with measurable security and clinical-resilience evidence.
Open guide Security operationsCybersecurity Operations
Build repeatable security operations, evidence, escalation, and control-review practices.
Open guide Vulnerability managementVulnerability Management Program
Prioritize exploited and exposed weaknesses, govern remediation and exceptions, verify closure, and report meaningful exposure.
Open guide Identity & accessIdentity & Access Management Program
Govern identity lifecycle, MFA, federation, privileged access, service identities, access reviews, and recovery controls.
Open guide Detection engineeringSecurity Logging & Detection Engineering
Design useful log coverage, resilient collection, retention, high-signal detections, investigation context, and measurable alert operations.
Open guide Cyber riskCyber Risk Assessment & Risk Register
Turn threat scenarios, business consequence, controls, ownership, treatment, and review triggers into a decision-ready risk register.
Open guide ExercisesCybersecurity Tabletop Exercise Program
Test incident authority, communications, recovery dependencies, evidence, and corrective action before a real crisis.
Open guide Governance reportingSecurity Metrics & Board Reporting
Build KPIs, KRIs, trend reporting, and executive risk narratives around decisions instead of vanity counts.
Open guide Cloud identitySaaS Access Governance
Govern federation, privileged access, lifecycle, guests, service identities, configuration drift, and tenant evidence.
Open guide Public-sector incidentsIncident Response Governance
Define decision rights, evidence, executive escalation, vendor coordination, recovery gates, and accountable corrective action.
Open guide Supplier cyber riskPublic-Sector Third-Party Cyber Risk
Apply current NIST supplier due diligence to evidence, contracting, monitoring, incident cooperation, continuity, and exit.
Open guide Small organizationsSmall Business Cybersecurity Survival Checklist
Prioritize practical controls when staff, budget, and specialist capacity are limited.
Open guide Personal securityCybersecurity for Home Users
Apply durable baseline protections to accounts, devices, networks, backups, and scams.
Open guide Network fundamentalsNetwork Security Fundamentals
Understand segmentation, access, encryption, monitoring, and resilient network design.
Open guide Application securitySecure API Development
Design APIs around explicit authentication, authorization, validation, logging, and lifecycle controls.
Open guide ArchitectureZero Trust Frameworks
Translate zero-trust principles into identity, device, workload, data, and network decisions.
Open guide Risk financingCyber Insurance Readiness
Prepare defensible renewal evidence, compare policy scenarios, and connect security controls to incident and claim readiness.
Open guide Cyber resilienceRansomware Recovery
Prove backups, identity, dependencies, clean-room procedures, and complete service restoration before an incident.
Open guide Microsoft 365 hardeningMicrosoft 365 CIS Hardening Tools
Compare CIS-CAT, CISA ScubaGear, Microsoft Baseline Security Mode, Secure Score, and native policy controls for scanning, remediation, impact analysis, and evidence.
Open guide Secure configurationSecurity Configuration Management
Version secure baselines, automate deployment, govern exceptions, detect drift, and verify restoration.
Open guide Email fraud defenseBusiness Email Compromise & Email Security
Protect payment workflows, mailboxes, domains, authentication, and response paths against BEC and impersonation.
Open guide Privileged accessPrivileged Access Management Program
Reduce standing privilege with stronger authentication, account separation, temporary elevation, vaulting, and monitoring.
Open guide Exposure managementExternal Attack Surface Management
Discover, own, prioritize, remediate, and verify internet-facing exposure across cloud, domains, services, and suppliers.
Open guide Endpoint defenseEndpoint Security & EDR Operations
Prove sensor coverage, prevention, telemetry, detections, investigation, isolation, and recovery work as one operating loop.
Open guide Human resilienceSecurity Awareness & Phishing Resilience
Build role-based learning, realistic phishing practice, faster reporting, behavior change, and incident feedback.
Open guide Secure designThreat Modeling & Architecture Review
Model trust boundaries and abuse paths, record design decisions, and turn security assumptions into verification.
Open guide Data protectionData Classification & DLP
Connect sensitive-data discovery and labels to handling rules, cloud and endpoint controls, exceptions, and measurable egress protection.
Open guide Cloud postureCloud Security Posture Management
Control identity, public exposure, encryption, logging, configuration drift, and multi-cloud security evidence.
Open guide Container securityKubernetes & Container Security
Secure images, workloads, secrets, admission, runtime, cluster administration, and software delivery boundaries.
Open guide Cryptographic lifecycleTLS Certificate & PKI Lifecycle
Inventory certificates, govern issuance, automate renewal, protect keys, monitor expiry, and handle compromise.
Open guide Mobile securityMobile Device & BYOD Security
Govern enrollment, device posture, identity, managed applications, enterprise data, privacy, incidents, and retirement.
Open guide Security frameworkNIST CSF 2.0 Implementation
Build current and target profiles, prioritize gaps, assign ownership, attach evidence, and measure risk reduction.
Open guide Prioritized controlsCIS Controls v8.1 Implementation
Use Implementation Groups, safeguard ownership, evidence, exceptions, and verification to build essential cyber hygiene.
Open guide AuthenticationMFA & Passwordless Authentication
Reduce account takeover with phishing-resistant authentication, passkeys, strong enrollment, and resilient recovery.
Open guide Remote accessSecure Remote Access & ZTNA
Reduce broad network trust with device posture, application-level access, VPN hardening, segmentation, and ZTNA.
Open guideInfrastructure
Infrastructure Resilience
Plan around failure domains, dependencies, recovery, lifecycle, and supply constraints.
Open guide Edge operationsEdge Infrastructure Resilience
Account for remote sites, carriers, power, hardware, support boundaries, and recovery.
Open guide FinOps anomaly responseCloud Cost Anomaly Management
Compare AWS, Azure and Google Cloud anomaly behavior and build one FinOps workflow for routing, investigation, false-positive tuning and cost-avoidance measurement.
Open guide ObservabilityCloud Observability
Connect telemetry to service health, investigation, reliability decisions, and operational evidence.
Open guide TelecomTelecom Modernization
Modernize voice, broadband, emergency communications, and critical connectivity around dependency inventory, migration evidence, resilience, and current public programs.
Open guide Sustainability dataInfrastructure Sustainability Reporting
Build traceable energy, emissions, water, waste, and facility evidence while keeping changing reporting obligations jurisdiction-specific.
Open guideDeveloper
CISA SBOM Minimum Elements 2025
Implement all 11 current minimum data fields plus automation, coverage, known-unknown, distribution, update, and validation practices.
Open guide Runtime lifecycleNode.js LTS & End-of-Life
Choose a supported 2026 production runtime, remove EOL lines, validate dependencies and delivery tooling, and prevent lifecycle drift.
Open guide \n TypeScript 4.9satisfies & Unlisted Property Narrowing
Use the 4.9 type-system changes without losing inference and migrate older code with official release behavior.
Open guide SSH authenticationOpenSSH 8.2, FIDO & ssh-rsa
Understand hardware-backed SSH keys and migrate RSA/SHA-1 signatures without incorrectly retiring compatible RSA/SHA-2 keys.
Open guide Policy as codeOpen Policy Agent & CNCF Graduation
Turn OPA project maturity into tested Rego, controlled distribution, observable decisions, and explicit enforcement semantics.
Open guide GitOps & workflow orchestrationArgo Workflows & CNCF Graduation
Understand Argo's graduated CNCF maturity, the four Argo projects, and the controls still required for production GitOps and Kubernetes workflows.
Open guide TypeScript 4.4Template String Index Signatures
Use pattern index signatures and aliased control-flow narrowing without giving up useful excess-property checks.
Open guide AI-assisted development historyGitHub Copilot Technical Preview
Understand what GitHub actually announced in June 2021, how editor-context code generation worked, and which governance lessons remain durable.
Open guide TypeScript genericsTypeScript 5.0 const Type Parameters
Learn literal-preserving generic inference, readonly constraints, limitations, API-design patterns, and migration guidance from the official TypeScript 5.0 behavior.
Open guide Engineering systemsDeveloper Enablement
Improve developer flow while keeping platform ownership, governance, and measurable outcomes visible.
Open guide Evidence in deliveryCI Compliance
Capture control evidence inside delivery workflows rather than reconstructing it after release.
Open guide Software supply chainSoftware Supply Chain Tooling
Use provenance, signing, dependency, SBOM, and verification controls to make releases inspectable.
Open guide AI-assisted developmentAI-Assisted Development Governance
Govern coding assistants and agents through data boundaries, permissions, review, testing, provenance, and secure-development controls.
Open guide Production readinessGovernment Software UAT & Production Readiness
Turn workflow UAT, accessibility, security, migration, rollback, support, and acceptance evidence into a defensible go-live decision.
Open guideData Strategy
Data Strategy Operating Model
Define ownership, decision rights, stewardship, evidence, and escalation around data.
Open guide StewardshipData Stewardship Operating Model
Turn stewardship roles into repeatable quality, access, issue, and accountability workflows.
Open guide Quality evidenceData Quality Assurance
Make quality dimensions, thresholds, exceptions, ownership, and evidence measurable.
Open guide InteroperabilityData Interoperability Engineering
Design exchange around explicit contracts, standards, mappings, validation, and lifecycle ownership.
Open guide Privacy transfersCross-Border Data Transfer Governance
Separate EU, UK, and U.S. transfer and sensitive-data mechanisms while preserving data-flow, vendor, legal-basis, and change evidence.
Open guideGovernance
HKMA CG-1 Version 4
Apply the current 2025 corporate-governance module across board accountability, risk culture, committees, director suitability, transparency, and supervisory evidence.
Open guide Risk oversightGovernance Risk Oversight
Define decision rights, escalation, evidence, and leadership visibility for technology risk.
Open guide Third partiesThird-Party Governance
Assign ownership and escalation before vendor evidence, contracts, monitoring, and exceptions fragment across teams.
Open guide Public sectorPublic-Sector Digital Governance
Connect current internal control, AI, procurement, supplier risk, accessibility, interoperability, assurance, and executive decision records.
Open guide Board oversightBoard Technology & Risk Oversight
Separate universal governance practices from SEC, UK, prudential, sustainability, and sector-specific board duties.
Open guide Sustainability governanceSustainability Governance & Accountability
Assign ownership, source authority, data, controls, assurance, and change monitoring without treating stayed or not-yet-effective rules as current mandates.
Open guideCompliance
ISO 27001:2022 Current Certification
Move beyond the expired 2013 transition deadline into current certificate verification, Annex A, evidence, scope, and Amendment 1:2024.
Open guide Digital AML/KYCEBA Remote Customer Onboarding
Implement risk-sensitive remote CDD with testable identity evidence, tool assurance, security, third-party oversight, monitoring, and supervisory evidence.
Open guide Singapore accountability & conductMAS IAC Software & Implementation
Translate the five Individual Accountability and Conduct outcomes into ownership, workflow, evidence, attestations, audit trails, and implementation questions.
Open guide OperationsCompliance Operations
Build an evidence operating model around controls, ownership, exceptions, review, and auditability.
Open guide Financial controlsSOX Modernization
Modernize technology-supported control evidence while keeping scoping, review, and accountability explicit.
Open guide Vendor monitoringThird-Party Risk Oversight
Carry vendor risk beyond selection into evidence refreshes, exceptions, monitoring, and exit decisions.
Open guide Privacy operationsPrivacy Enforcement Readiness
Build jurisdiction-specific source packs and operational evidence for transparency, rights, assessments, vendors, sensitive-data restrictions, and regulator response.
Open guidePolicy
AI Policy Implementation
Separate EU AI Act duties, federal agency policy, voluntary risk guidance, contracts, and internal controls while tracking fast-moving authority changes.
Open guide Digital marketsDigital Markets Compliance
Structure platform and market-regulation analysis around applicability, current authority, status, and evidence.
Open guide Policy engagementPolicy Advocacy Roadmap
Plan stakeholder mapping, evidence, comment, communication, and decision ownership without treating dated examples as standing requirements.
Open guideFast-changing requirements get a shorter review cycle.
Legal obligations, sanctions, funding programs, product capabilities, and industrial-policy conditions can change faster than durable implementation patterns. Zeph Tech does not promote a guide as maintained when its current-state review is incomplete.
- Check the review date. A current date is evidence of review, not a substitute for the cited primary source.
- Separate guidance from legal advice. Applicability depends on jurisdiction, sector, facts, and effective dates.
- Use the correction path. Flag a source, date, scope statement, or recommendation that needs another look.
Turn the implementation question into evidence you can compare.
Use the procurement toolkit and evaluation brief when a guide turns into a vendor, migration, workflow, or platform decision.