COS-07 Documentation of the network topology
Keep traceable and current documentation of the logical network used to provide the service, showing subnet allocation, zoning and segmentation together with the geographic locations holding customer data, to avoid admin
4
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence that the drawing is amended as part of every network change · Cloud console / configuration management
governing documentDocuments that govern the control
- Current logical network drawing carrying a revision date and a named owner · Policy repository / GRC workspace
- Subnet allocation register mapping address ranges to zones and purposes · Policy repository / GRC workspace
- Statement of the physical sites at which customer data is held · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Drawings predate recent network work, so live routing differs from what is depicted
- Storage locations omitted, leaving customers unable to assess data residency
- No accountable owner, so updates depend on whichever engineer remembers
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCOS-06 Segregation of data traffic in jointly used network environments · COS-08 Policies for data transmission