diff --git a/modules/ROOT/pages/security-settings.adoc b/modules/ROOT/pages/security-settings.adoc
index a0a1a3131..1d4cbd94e 100644
--- a/modules/ROOT/pages/security-settings.adoc
+++ b/modules/ROOT/pages/security-settings.adoc
@@ -21,6 +21,44 @@ To avoid this issue, ThoughtSpot recommends the following:
 * If you are using a ThoughtSpot Cloud instance, set up your instance to the same domain as your host application. For more information, see link:https://docs.thoughtspot.com/cloud/latest/custom-domains[Custom domain configuration, window=_blank].
 * If you are using authentication methods that rely on cookies, xref:_enable_partitioned_cookies[enable partitioned cookies].
 
+[#network-access-requirements]
+== Network access requirements
+
+If your organization uses a firewall or Content Delivery Network (CDN) with domain-level access controls, you must allowlist the following domains before provisioning a new ThoughtSpot cluster or modifying an existing firewall configuration. Without access to the critical domains, ThoughtSpot will not load.
+
+=== Critical domains
+
+Allowlist the following domains to ensure ThoughtSpot loads correctly. If any of these are blocked, ThoughtSpot will not function.
+
+[options="header",cols="2,3"]
+|===
+|Domain |Purpose
+|`+*.thoughtspot.cloud+` |ThoughtSpot application and APIs
+|`+*.thoughtspotartifacts.cloud+` |Static assets and build artifacts
+|`+*.thoughtspotlogin.cloud+` |Authentication and login flows
+|`+ok14static.oktacdn.com+` |Okta authentication assets
+|`+*.cloudfront.net+` |CDN-served ThoughtSpot resources
+|`+cdn.skypack.dev+` |JavaScript module delivery
+|`+cdn.jsdelivr.net+` |Open-source library assets
+|`+cdnjs.cloudflare.com+` |Open-source library assets
+|`+code.jquery.com+` |jQuery library
+|===
+
+=== Optional domains
+
+Allowlist the following domains if you use the corresponding ThoughtSpot features.
+
+[options="header",cols="2,3"]
+|===
+|Domain |Feature
+|`+cdn.mxpnl.com+` |Mixpanel product analytics
+|`+app.pendo.io+` |Pendo in-app guidance
+|`+cdn.pendo.io+` |Pendo in-app guidance
+|`+fonts.googleapis.com+` |Google Fonts
+|`+js.intercomcdn.com+` |Intercom in-app support
+|`+fast.wistia.com+` |Wistia embedded video content
+|===
+
 == Configure security settings
 
 Users with administration privileges can configure security settings on the Security settings page of the ThoughtSpot UI, or by sending a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Note that the following settings on the **Security Settings** page will appear as locked for ThoughtSpot Analytics application users and will require an embedding license: