What it asks for. This control expects networks and network devices to be secured, managed and controlled to protect information in systems and applications. The aim is to protect information that passes through networks and the facilities that process it.
In practice. Good practice includes defined responsibilities for network management, hardened and patched network devices, secure management access, protection of data in transit where needed and logging and monitoring of network activity. Network documentation and diagrams are kept up to date. Auditors expect configuration standards, change records for network devices, access controls on management interfaces and evidence of monitoring.
Common gaps. Common gaps are outdated network diagrams, default or shared credentials on network devices and management interfaces exposed to user networks or the internet. Remote access paths set up for projects or suppliers are also often left open after they are no longer needed.