Free quiz · Appendix B of Book 9 · Corporate HQ and multi-site

Score your corporate network diagram

Open your current drawing, the real one. Tick each question you can answer yes. Each yes is worth 5 points.

Partly means no. "Most of it has a zone table" is a no.
Verbal knowledge doesn't count. If the answer lives in your head and not on the page, it's a no.
Check, don't remember. Look at one real device or cable and compare.

This is the corporate hq and multi-site scorecard from Book 9, Draw Secure Corporate Network Diagrams. Each book in the series has its own. Pick another industry.

Most low scores come from a drawing typed by hand that stopped matching the network. Draw the corporate standard from your NetBox data with the free tool, or read the free chapter first: Enterprise network zones.

What auditors check

What an audit-ready network diagram includes: every security zone with a guarded edge and the device that enforces it; every connection to outside networks, wireless included; the VLANs and subnets in each zone; a flow register of what may cross each boundary, under default deny; and an owner, a date and the source it was drawn from. Score yours below: each question names the chapter that fixes it.

Who asks for it: SOC 2 and ISO/IEC 27001 auditors. ISO/IEC 27001:2022 Annex A control 8.22 asks for groups of information services, users and systems to be segregated in the organization's networks, and SOC 2 auditors usually ask for a current network diagram when they test logical access and boundary controls (criteria CC6.1 and CC6.6).

Part 1. Pages, readers and authors

1. Is there one current set per site, built to one standard, with overview, logical and physical pages at least, and no competing versions in circulation?CHAPTER 1, 132. Could a board member read the overview and say in their own words what is protected, and what happens if the data center or the WAN fails?CHAPTER 23. Does every sheet carry a title block with site, date and revision, and a line saying where its facts came from?CHAPTER 2, 144. When several people edit the drawings, does each fact have one place it is recorded (NetBox or one workbook), with a written rule about who edits what?CHAPTER 13

Part 2. Zones, VRFs and firewalls

5. Are the big zones drawn as VRFs (or whatever really separates them), with every VLAN in exactly one zone and its VRF stated?CHAPTER 3, 46. Is every VLAN's gateway on the page, so a reader can tell routed-inside-a-VRF from crossing-a-firewall?CHAPTER 47. Are the internal and edge firewall pairs drawn where zones meet, each with its interfaces and the zone each faces?CHAPTER 3, 48. Does the data center show its tiers as zones, with where each tier's gateway lives and which firewall inspects tier-to-tier traffic?CHAPTER 69. Does the drawing say how a device is placed in a zone (802.1X, NAC, quarantine), not only which port it uses?CHAPTER 8

Part 3. The physical company

10. Does every backbone link carry its real cable label, members, speed, media and VLANs, and does the campus fiber show which duct each run uses?CHAPTER 511. Is there a riser view of every multi-building or multi-floor site, with its closets and the fiber between them?CHAPTER 512. Is every pair drawn member by member (core, distribution, leafs, firewalls, controllers), with a sheet that says what users notice when each fails, the data center included?CHAPTER 713. Does every SSID show its security, VLAN and zone, and does the guest SSID say it is isolated and never routed internally?CHAPTER 8

Part 4. Sites, conversations and policy

14. Are branches drawn as typicals plus a site table, with the hubs, the DR site, the cloud transit and spokes, and home workers each drawn as themselves?CHAPTER 1115. Does every tunnel and outside party (MSSP, contractors, clients, carriers) have a line or a register row with a named owner, including any tunnel whose purpose is still unknown?CHAPTER 9, 1116. Is there a flow register with an owner on every row, a default-deny row and a zone matrix with an answer in every cell?CHAPTER 1017. In the last twelve months, has the register been compared with the configuration of every firewall that enforces it, the DR pair and the branches included?CHAPTER 17

Part 5. Keeping it true and sharing it

18. Is drift measured on a schedule for every site or region, with the differences and unknowns kept in a dated gaps register (WS-11)?CHAPTER 1419. Could you send a client's security reviewer a copy with no management IPs, serials, circuit IDs or NetBox links within fifteen minutes, and does a sharing log record who has received what?CHAPTER 1520. If the company bought another one tomorrow, is there a written plan for drawing its network before the two are joined?CHAPTER 16

Your result

Tick the questions above

Your tier appears here as you go.

Share your tier, not your drawing.

Raise your score with Book 9 · $39

Network Diagrams by Industry · Book 9

Draw Secure Corporate Network Diagrams: From Campus Core to Branch WAN

Every question names the chapter that fixes it, so every low score is a reading list.

The rest of the book: VRFs and internal firewalls, campus fiber and risers, the data center, SD-WAN branches, and a chapter on law firms and the ethical wall. One-time payment, 14-day refund.

Get the full book · $39 See all chapters

Scorecards for other industries

Every book ends with a 20-question scorecard written for its own networks. Take any of them free.

Free quiz · Book 1, Appendix B

Drawn is not enforced

Your diagram says what should be allowed. The firewall decides what is. SegAudit checks firewall exports against your zones and never touches the network.

Check yours with SegAudit →

0/100

Score your corporate network diagram

Part 1. Pages, readers and authors

Part 2. Zones, VRFs and firewalls

Part 3. The physical company

Part 4. Sites, conversations and policy

Part 5. Keeping it true and sharing it

Tick the questions above

Scorecards for other industries

Score your plant network diagram

Score your school network diagram

Score your warehouse network diagram

Score your store network diagram

Score your office network diagram

Score your bank network diagram

Score your local government network diagram

Score your hotel network diagram

Score your dealership network diagram