Free quiz · Appendix B of Book 5 · Offices

Score your office network diagram

Open your current drawing, the real one. Tick each question you can answer yes. Each yes is worth 5 points.

Partly means no. "Most of it has a zone table" is a no.
Verbal knowledge doesn't count. If the answer lives in your head and not on the page, it's a no.
Check, don't remember. Look at one real device or cable and compare.

This is the offices scorecard from Book 5, Draw Secure Small Office Network Diagrams. Each book in the series has its own. Pick another industry.

Most low scores come from a drawing typed by hand that stopped matching the network. Draw the office standard from your NetBox data with the free tool, or read the free chapter first: Small office network zones.

What auditors check

What an audit-ready network diagram includes: every security zone with a guarded edge and the device that enforces it; every connection to outside networks, wireless included; the VLANs and subnets in each zone; a flow register of what may cross each boundary, under default deny; and an owner, a date and the source it was drawn from. Score yours below: each question names the chapter that fixes it.

Who asks for it: cyber insurers' questionnaires, clients' security reviews (often against SOC 2 or ISO/IEC 27001) and the next IT provider. A current diagram answers most of their network questions on one page.

Part 1. Pages and readers

1. Do you have separate pages for separate readers: at least an overview, a logical page and a physical page?CHAPTER 12. Could a partner or owner read the overview and say, in their own words, what is protected and what happens if the internet line goes down?CHAPTER 23. Does every page carry a title block with the site, the date and a revision, filled in?CHAPTER 2, 134. Is there one legend for colors, line styles and symbols, and does every page actually follow it?CHAPTER 3, 4

Part 2. Zones and VLANs

5. Are staff, guests, printers, servers, meeting rooms, building systems and network management each drawn in a named zone (or is the decision to combine two of them written down)?CHAPTER 36. Does every VLAN and subnet appear in exactly one zone, with its ID and name?CHAPTER 47. Does every VLAN show its gateway, so a reader can tell which device routes between zones?CHAPTER 48. Is the firewall drawn where the zones meet, with every member of the pair and a table of its interfaces and the zone each one serves?CHAPTER 3, 49. Is every device the office doesn't own (the provider's router, the landlord's panel, the AV contractor's box) drawn, with its owner and its zone?CHAPTER 3, 6

Part 3. The physical office

10. Does every drawn backbone link carry the label printed on the real cable?CHAPTER 511. Do switch uplinks show their port-channel members, speed, media and the VLANs they carry?CHAPTER 512. Is everything in the comms room and floor closets on the page (provider handoffs, UPSs, the console server, every box on the shelf), with what each UPS powers?CHAPTER 613. Are the firewall pair, the switch stacks and both internet lines drawn member by member, with a page that says what users notice when each one fails?CHAPTER 714. Does every SSID appear with its VLAN, zone and security, and does the guest SSID say that clients can't see each other?CHAPTER 8

Part 4. Conversations and policy

15. Are flows drawn from the side that starts them to the side that answers, including remote staff and outside support access with their conditions (VPN, MFA, booked window)?CHAPTER 916. Are the important denials drawn on purpose: guests to anything internal, building systems to the internet, everyone else to network management?CHAPTER 917. Is there a flow register with a default-deny row and a zone matrix with an answer in every cell, and has it been compared to the firewall's actual rules in the last twelve months?CHAPTER 10, 16

Part 5. Keeping it true

18. Do the typed facts (IPs, serials, VLAN tables) come from one source of record, such as NetBox, instead of being typed into the drawing?CHAPTER 1219. Has the drawing been checked against the real office in the last 90 days, with the differences and unknowns kept in a dated gaps register (WS-11)?CHAPTER 13, 1520. Could you send an insurer or a client's security reviewer a version with management IPs, serials and circuit IDs removed, within ten minutes?CHAPTER 14

Your result

Tick the questions above

Your tier appears here as you go.

Share your tier, not your drawing.

Raise your score with Book 5 · $39

Network Diagrams by Industry · Book 5

Draw Secure Small Office Network Diagrams: From Front Desk to Firewall

Every question names the chapter that fixes it, so every low score is a reading list.

The rest of the book: One firewall in the middle, MSP access, cloud and remote work, and branches, drawn for the insurer's questionnaire and the next MSP. One-time payment, 14-day refund.

Get the full book · $39 See all chapters

Scorecards for other industries

Every book ends with a 20-question scorecard written for its own networks. Take any of them free.

Free quiz · Book 1, Appendix B

Drawn is not enforced

Your diagram says what should be allowed. The firewall decides what is. SegAudit checks firewall exports against your zones and never touches the network.

Check yours with SegAudit →

0/100

Score your office network diagram

Part 1. Pages and readers

Part 2. Zones and VLANs

Part 3. The physical office

Part 4. Conversations and policy

Part 5. Keeping it true

Tick the questions above

Scorecards for other industries

Score your plant network diagram

Score your school network diagram

Score your warehouse network diagram

Score your store network diagram

Score your bank network diagram

Score your local government network diagram

Score your hotel network diagram

Score your corporate network diagram

Score your dealership network diagram