[SSP] environment: Operating Environment
On-premises Windows Server 2025 and Windows 11 with Entra ID for identity. Backups go to an off-site encrypted target (see POA&M for 3.13.11). Remote access is via the gateway with MFA; vendor maintenance access is being moved behind the bastion (POA&M for 3.1.12 and 3.13.1).

