Security
Management-plane security
AAA is the base. TACACS+ (TCP 49) encrypts the entire payload and separates authentication, authorization, and accounting, making it the better fit for per-command device administration; RADIUS (UDP) encrypts only the password. RBAC roles limit what an authenticated user may do - network-admin is all-powerful, so scope custom roles and assign them per user or VDC.
CoPP classifies and polices traffic destined to the supervisor (BGP, SSH, ICMP). An overly tight policy silently breaks peering, so know the default class names before tuning.
Data-plane and Layer 2 hardening
DHCP snooping builds a binding table; dynamic ARP inspection and IP source guard both consume it, so they are deployed together. Port security limits MACs per port with sticky learning and protect/restrict/shutdown violation modes. Private VLANs (primary, isolated, community) restrict east-west traffic on a segment. 802.1X with MAB authenticates endpoints, and MACsec encrypts hop by hop on supported links.
ACL placement matters: RACL on a routed SVI, PACL on a physical port, VACL applied VLAN-wide with vlan filter. All are top-down, first-match, with an implicit deny.
Worked example
A host can ping its gateway but not a server across an SVI: check the RACL direction (inbound on the ingress SVI), confirm it is actually applied to that SVI, and look for a missing return-path permit rather than assuming routing is broken.
Rule of thumb
Before applying any filter to VTY lines or a CoPP class, add explicit permits for the management protocols you depend on - the implicit deny is exactly where lockouts come from.