What it asks for. This category asks that security architectures are managed in line with the organisation's risk strategy to protect the confidentiality, integrity and availability of assets and to make the organisation resilient. It covers protecting networks from unauthorised logical access, environmental threats, resilience mechanisms and adequate capacity.
In practice. Networks are segmented according to trust and function, with controls on traffic between zones and on remote access. Critical systems have redundancy, failover and capacity planning, and facilities are protected against power loss, fire and similar threats. Resilience requirements are set from business impact analysis and tested. Evidence includes network diagrams, firewall and segmentation rule reviews, capacity reports, failover test results and data centre or cloud provider assurance reports.
Common gaps. Organisations often have flat internal networks, undocumented exceptions in firewall rules and single points of failure in key services. Resilience is frequently assumed from cloud providers rather than designed and tested.