Free quiz · Appendix B of Book 6 · Banks and credit unions

Score your bank network diagram

Open your current drawing, the real one. Tick each question you can answer yes. Each yes is worth 5 points.

Partly means no. "Most of it has a zone table" is a no.
Verbal knowledge doesn't count. If the answer lives in your head and not on the page, it's a no.
Check, don't remember. Look at one real device or cable and compare.

This is the banks and credit unions scorecard from Book 6, Draw Secure Bank and Credit Union Network Diagrams. Each book in the series has its own. Pick another industry.

Most low scores come from a drawing typed by hand that stopped matching the network. Draw the bank standard from your NetBox data with the free tool, or read the free chapter first: Bank network zones.

What auditors check

What an audit-ready network diagram includes: every security zone with a guarded edge and the device that enforces it; every connection to outside networks, wireless included; the VLANs and subnets in each zone; a flow register of what may cross each boundary, under default deny; and an owner, a date and the source it was drawn from. Score yours below: each question names the chapter that fixes it.

What examiners look for: the FFIEC Information Security booklet expects management to keep accurate network diagrams and data flow charts and to store them securely (section II.C.9, Network Controls), and the Architecture, Infrastructure, and Operations booklet covers the same ground. Banks follow the GLBA Interagency Guidelines and credit unions NCUA Part 748. See the FFIEC IT Examination Handbook.

Part 1. Pages and readers

1. Do you have separate pages for separate readers: at least an overview, a logical page and a physical page?CHAPTER 12. Could a board member (or supervisory committee member) read the overview and say, in their own words, what is protected and what happens if the core circuit drops?CHAPTER 23. Does every page carry a title block with the institution, the site, the date and a revision, filled in, and is that date within the last 90 days?CHAPTER 2, 134. Is there one legend for colors, line styles and symbols, and does every page follow it?CHAPTER 3, 4

Part 2. Zones and VLANs

5. Are teller, platform and back office, servers, ATMs, guests, physical security and network management each drawn in a named zone (or is the decision to combine two written down)?CHAPTER 36. Are the wire room and card issuing each drawn as their own zone, with their own small subnet and nothing else in it?CHAPTER 37. Does every VLAN appear in exactly one zone, with its ID, name, subnet and gateway?CHAPTER 48. Is the firewall drawn where the zones meet, every member of the pair, with a table of its interfaces and the zone each serves?CHAPTER 3, 49. Is the core processor's router drawn as a device, with its owner, its circuit and the port it plugs into on your side?CHAPTER 3, 11

Part 3. The physical bank

10. Does every drawn backbone link carry the label printed on the real cable, plus its members, speed, media and the VLANs it carries?CHAPTER 511. Is every device the bank doesn't own or doesn't run (the core processor's router, the alarm panels, the ATMs, the cash recyclers) drawn with its owner and its zone?CHAPTER 612. Is everything in the comms room and each branch cabinet on the page, including the UPSs (with what each powers) and the out-of-band console?CHAPTER 5, 613. Are both internet lines, the core circuit and the branch WAN drawn, with a page that says what tellers notice when each one fails?CHAPTER 714. Does every SSID appear with its VLAN, zone and security, and is it clear that no SSID reaches teller, wire, card or ATM?CHAPTER 8

Part 4. Conversations and policy

15. Are outside parties' ways in (the MSP, the ATM servicer, remote staff) drawn as flows with their conditions: VPN, MFA, named accounts, booked windows?CHAPTER 916. Is there a flow register with explicit deny rows for the wire room, card issuing, guests and network management, a default-deny row, and a zone matrix with an answer in every cell?CHAPTER 1017. Has the register been compared to the firewall's actual rules, at B01 and at a branch, in the last quarter?CHAPTER 16

Part 5. Keeping it true

18. Do the typed facts (IPs, serials, VLAN tables) come from one source of record, such as NetBox, instead of being typed into the drawing?CHAPTER 1219. Is there a dated gaps register (WS-11) with an owner for every unknown, and has the drawing been checked against the comms room in the last 90 days?CHAPTER 13, 1520. Could you send the board a one-page copy, and a vendor a copy with management IPs, serials, circuit IDs and camera placements removed, within ten minutes?CHAPTER 14

Your result

Tick the questions above

Your tier appears here as you go.

Share your tier, not your drawing.

Raise your score with Book 6 · $39

Network Diagrams by Industry · Book 6

Draw Secure Bank and Credit Union Network Diagrams: From Teller Line to FFIEC Exam

Every question names the chapter that fixes it, so every low score is a reading list.

The rest of the book: Teller, wire room and card zones, the core processor's router, ATMs and alarm boxes, and branches, drawn for the examiner's request list. One-time payment, 14-day refund.

Get the full book · $39 See all chapters

Scorecards for other industries

Every book ends with a 20-question scorecard written for its own networks. Take any of them free.

Free quiz · Book 1, Appendix B

Drawn is not enforced

Your diagram says what should be allowed. The firewall decides what is. SegAudit checks firewall exports against your zones and never touches the network.

Check yours with SegAudit →

0/100

Score your bank network diagram

Part 1. Pages and readers

Part 2. Zones and VLANs

Part 3. The physical bank

Part 4. Conversations and policy

Part 5. Keeping it true

Tick the questions above

Scorecards for other industries

Score your plant network diagram

Score your school network diagram

Score your warehouse network diagram

Score your store network diagram

Score your office network diagram

Score your local government network diagram

Score your hotel network diagram

Score your corporate network diagram

Score your dealership network diagram