Wise advice from @n0x08 to "make sure your BMCs are off the internet" but this can be harder than it looks because of NC-SI. For assurance in the past, I've had to leave the motherboard network ports unconnected and add network cards instead.