Networks are logically separated so no link carries traffic its hosts cannot service: network management authenticates all users and encrypts management traffic; no single failure causes denial of service; an IDS/IPS listens to internal and external traffic and detects or prevents DDoS, shellcode traversal, ARP spoofing and other man-in-the-middle indicators, severing communications immediately; on a WLAN the IDS/IPS scans for rogue access points and devices at least quarterly, disables them automatically and keeps a 90-day wireless access history reconcilable with other network devices; network communication equipment resists physical damage and firmware corruption, is physically and logically secured and disables communication or offloads logs when its audit log fills; hubs, services and ports are secured with unused services and non-essential ports blocked or disabled; redundant virtual server instances do not share a hypervisor; stateless protocols such as UDP do not carry sensitive information unless a stateful transport is used; all network infrastructure changes are logged; and virus scanners are installed and updated on all systems.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.