Encrypt sensitive network communications using strong cryptographic protocols.

• Enforce TLS 1.2+ for all web traffic; prefer TLS 1.3
• Use IPsec for site-to-site tunnels
• Implement MACsec (802.1AE) for LAN encryption where supported
• Disable SSLv3, TLS 1.0, TLS 1.1 and weak cipher suites