Network Architecture Diagram Evidence Requirements

Document control

Field	Value
Document status	Active policy document
Owner	Security / Operations
Approver	Management
Review frequency	Annual or on material change
Classification	Customer-shareable

Purpose

Define required contents for network and solution architecture diagrams used in security reviews.

Required components

Diagrams should identify users, DNS, CDN/WAF if applicable, load balancer, ingress/proxy, application services, workers, databases, file storage, backups, logs, monitoring, admin path, and third-party integrations.

Security boundaries

Diagrams should show public/private zones, production/staging/development boundaries, identity/admin boundary, customer/environment segregation, and region/location assumptions where relevant.

Data flows

Diagrams should show inbound user traffic, API calls, document/file upload, database and file operations, backup flows, logging flows, support/admin access, and outbound integrations.

Required annotations

Include encryption, authentication, authorization, monitoring, backup, ownership, and critical dependencies.

Evidence to maintain

Architecture diagram, data-flow diagram, component inventory, integration list, security boundary notes, and review approval.