IVS-09 Network Defense
Apply defence in depth against network attack, covering prevention, detection and timely response, through defined and evaluated processes.
4
artefacts
2
held by a system
1
at each review
easy
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration of the defensive controls at each layer · Cloud console / configuration management
- Evidence of detection working, such as alerts raised and handled · SIEM / log platform
periodic reviewEvidence produced at each review
- Evaluation records such as testing or a purple team exercise · Cloud console / configuration management
governing documentDocuments that govern the control
- The layered network defence design showing prevention, detection and response · Policy repository / GRC workspace
First move
Automate the pull from your Cloud console / configuration management. Configuration snapshots and change history from the cloud console or IaC repository, diffed against the baseline.
Common gaps auditors find
- Single layer of defence at the perimeter with nothing inside it
- Detection deployed with no defined response path
- Controls deployed and never evaluated for effectiveness
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIVS-08 Network Architecture Documentation · LOG-01 Logging and Monitoring Policy and Procedures