The entity must document and implement network security management covering: segregation and segmentation by the criticality of supported functions, classification and risk; documentation of all network connections and data flows; a separate dedicated network for administration; network access control to prevent and detect unauthorised or non-compliant devices; encryption of connections over corporate, public, domestic, third-party and wireless networks according to classification and risk; network design to the entity's security requirements and leading practice; securing traffic to the internet and other external links; roles and steps for specifying, approving, changing and reviewing firewall rules and connection filters, reviewed regularly by classification and at least every six months for systems supporting critical or important functions; yearly review of network architecture and security design (periodically for microenterprises); temporary isolation of subnets and devices; secure baselines and hardening of network components; locking and ending idle sessions; and for network service agreements, the security measures, service levels and management requirements of each service and whether it is intra-group or third-party.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.