[Practice] Systems must be set up in a protected network environment or by using a method that assures the system is not accessible via a potentially hostile network until it is secured. [Category I] Required [Category II & III] 
Recommended