Network documentation goes stale quietly. Devices are added, a remote access account is opened for a contractor, a rule is changed for a project, and nobody updates the page. A short, regular review keeps the documents describing the network you actually have.
One thing to be clear about before you start. Nothing here tells you whether any document satisfies anything, and nothing here identifies what you are obliged to produce. Which frameworks, standards and obligations apply to an organization varies by organization, by industry and by jurisdiction, and working out which ones apply to you belongs with a qualified professional who knows your situation. This is a documentation review, not an audit or an assessment, and it does not test or verify the security of anything. It checks whether the documents still match reality, and records what changed.
The documents to review
- Network diagram. A simple drawing of how locations, systems and connections fit together.
- Device list. Every device that connects to the network, with an owner for each.
- Remote access list. Who can connect from outside, by what approved method, and on whose approval.
- Firewall rule record. The plain-language record of what each rule is for.
- Owner list. Who is responsible for each system and each document.
Who sits in
Two people are enough: the person who looks after the network day to day, and the person who owns the documents. The first knows what changed; the second makes sure the change is written down.
How to run the review
- Open each document in turn. Read it aloud if that helps. The question for every line is simply: is this still true?
- Mark what has changed. Note additions, removals and anything nobody can explain. An unexplained entry is recorded as an open question with an owner, not guessed at.
- Update the documents. Make the changes, save a new version and keep the old one.
- Record the review. Write down the date, who took part, which documents were checked, what changed and which questions are still open.
- Sign it off. The document owner confirms the review is complete.
The review record
| Field | What to write |
|---|---|
| Date | When the review took place |
| Participants | Who took part |
| Documents checked | Each document and its version after the review |
| Changes | What was added, removed or corrected |
| Open questions | Anything unresolved, with an owner |
| Sign-off | The document owner’s name and date |
Choosing the cadence
The title says each quarter because that suits many small organizations, but the right cycle is a decision for your organization to make and write down. Add an off-cycle review whenever the network changes materially, such as a move, a new location or a change of provider.
What the review is not
A completed review shows that the documents were checked against reality on a date. It is not a credential and says nothing about how well the network is run. Questions about that belong with a qualified professional.
When you are ready to gather the documents that sit alongside this one, work through the Trust Center Document Checklist page on this site and fill the gaps one document at a time.