Free quiz · Appendix B of Book 1 · Manufacturing

Score your network diagram

Open your current drawing, the real one. Tick each question you can answer yes. Each yes is worth 5 points.

Partly means no. "Most of it has a zone table" is a no.
Verbal knowledge doesn't count. If the answer lives in your head and not on the page, it's a no.
Check, don't remember. Look at one real device or cable and compare.

This is the manufacturing scorecard from Book 1, Draw Secure Manufacturing Network Diagrams. Each book in the series has its own. Pick another industry.

Most low scores come from a drawing typed by hand that stopped matching the network. Draw the plant standard from your NetBox data with the free tool, or read the free chapter first: Purdue model network diagram.

What auditors check

What an audit-ready network diagram includes: every security zone with a guarded edge and the device that enforces it; every connection to outside networks, wireless included; the VLANs and subnets in each zone; a flow register of what may cross each boundary, under default deny; and an owner, a date and the source it was drawn from. Score yours below: each question names the chapter that fixes it.

What reviewers check: IEC 62443-3-2 asks for business, safety-related, temporarily connected, wireless and external connections to be separated from control systems (ZCR 3.2 to 3.6) and for zone and conduit drawings in the documentation (ZCR 6.3). NIST SP 800-82 Rev. 3 uses the same zoned, Purdue-style architecture.

Part 1. Audiences and pages

1. Do you have separate pages for different audiences (at least an overview, a logical page and a physical page)?CHAPTER 12. Could your plant manager read the overview page and say what is protected and how, without asking you a single acronym?CHAPTER 23. Does every page have a title block with site, date and revision filled in?CHAPTER 24. Is there a legend that explains every color, line style and symbol used, and does every page follow it?CHAPTER 3, 4

Part 2. Zones and addressing

5. Are your zones drawn and stacked by Purdue level, with the IDMZ (or the decision not to have one) visible?CHAPTER 36. Does every routed subnet appear in exactly one zone, with its VLAN ID and name?CHAPTER 47. Does every subnet show its gateway and its VRF (or say plainly that it has none)?CHAPTER 48. Is every boundary device drawn across its boundary, with its interfaces and the zone each one faces?CHAPTER 49. Does every VLAN have a name that follows a written naming pattern, with no unexplained TEMP or TEST entries?CHAPTER 4

Part 3. The physical layer

10. Does every drawn link carry a label that matches the label on the real cable?CHAPTER 511. Do inter-switch links show their trunked VLANs, and port-channels show their members?CHAPTER 512. Is media recorded as a type (for example OS2, OM3, Cat6A) rather than "fiber" or "copper", with optics noted where they matter?CHAPTER 613. Are HA pairs, stacks and virtual chassis drawn member by member, and rings drawn as closed rings with their blocking point?CHAPTER 714. Are wireless controllers, SSIDs (with VLAN and zone) and point-to-point radio links drawn as such?CHAPTER 8

Part 4. Flows and segmentation

15. Are permitted flows drawn from initiator to responder, with protocol or port?CHAPTER 916. Are important denied paths drawn or listed explicitly, not just left out?CHAPTER 917. Is there a flow register or zone matrix that gives every pair of zones an answer, and has it been compared to the firewall rules in the last twelve months?CHAPTER 10, 16

Part 5. Keeping it true

18. Do typed facts (IPs, serials, VLAN tables) come from one source of record, such as NetBox, rather than being typed into shapes by hand?CHAPTER 1219. Have you compared the drawing against reality (devices, cables, VLANs) in the last 90 days, and kept the differences and unknowns in a dated gaps register (Appendix G, WS-11)?CHAPTER 13, 1520. Can you produce a version for an outside party with management IPs, circuit IDs and VLAN tables removed, in under ten minutes?CHAPTER 14

Your result

Tick the questions above

Your tier appears here as you go.

Share your tier, not your drawing.

Raise your score with Book 1 · $39

Network Diagrams by Industry · Book 1

Draw Secure Manufacturing Network Diagrams: From Plant Floor to Purdue Model

Every question names the chapter that fixes it, so every low score is a reading list.

The other chapters cover the logical and physical pages, optics, rings and failover, wireless, flows, multi-site, drift and sharing safely. One-time payment, 14-day refund.

Get the full book · $39 See all chapters

Scorecards for other industries

Every book ends with a 20-question scorecard written for its own networks. Take any of them free.

Free quiz · Book 2, Appendix B

Drawn is not enforced

Your diagram says what should be allowed. The firewall decides what is. SegAudit checks firewall exports against your zones and never touches the network.

Check yours with SegAudit →

0/100

Score your network diagram

Part 1. Audiences and pages

Part 2. Zones and addressing

Part 3. The physical layer

Part 4. Flows and segmentation

Part 5. Keeping it true

Tick the questions above

Scorecards for other industries

Score your school network diagram

Score your warehouse network diagram

Score your store network diagram

Score your office network diagram

Score your bank network diagram

Score your local government network diagram

Score your hotel network diagram

Score your corporate network diagram

Score your dealership network diagram