Establish and Maintain Architecture Diagram(s)
Description
Establish and maintain architecture diagram(s) and/or other network system documentation. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
Implementation Checklist
Tool Recommendations
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Enterprise firewall and security fabric with NGFW, SD-WAN, IPS, and integrated security services
Fortinet · Appliance + subscription
Enterprise firewall with application visibility, IPS, malware defense, and encrypted traffic analytics
Cisco · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Unidentified Attack Paths Through Undocumented Network Topology
ConfidentialityWithout current architecture diagrams, security teams cannot identify attack paths, network trust boundaries, or segmentation gaps, leaving them unable to proactively defend against threats or accurately scope incident response.
Security Control Gaps from Undocumented Network Changes
IntegrityNetwork changes made without updating architecture documentation create undocumented connections, bypassed firewalls, and rogue network paths that introduce security vulnerabilities unknown to the security team.
Ineffective Incident Response Due to Inaccurate Network Maps
AvailabilityDuring incident response, teams rely on outdated or non-existent architecture diagrams, leading to incorrect containment actions, missed compromised segments, and inability to identify all affected systems.
Vulnerabilities (When Safeguard Absent)
No Current Network Architecture Documentation
The organization has no up-to-date architecture diagrams showing network topology, segmentation boundaries, trust zones, data flows, and external connections, leaving security teams without the visibility needed for effective defense.
Architecture Diagrams Not Updated With Network Changes
Network architecture diagrams exist but are not updated when changes are made, rendering them inaccurate and potentially misleading for security analysis, compliance audits, and incident response activities.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |