Network-device hardening

A managed network switch hardened and annotated with nine numbered controls: placement on a management VLAN 99 (10.20.99.0/24) with approved admin hosts only, a dedicated management IP, unused ports administratively disabled, restricted management access, a physical port lock, and SNMPv3 authPriv, syslog over TLS, authenticated NTP and RADIUS services, plus a sealed local emergency account.