ID.AM-03 says representations of the organization's authorized network communication and internal and external network data flows are maintained. That means diagrams and documented baselines of who talks to whom, over which ports and protocols, including links to third parties and your cloud infrastructure.
CSF is voluntary guidance. There is no CSF certification.
What good looks like
A current network diagram and a data flow diagram exist for your main systems. Expected ports, protocols and services between authorized systems are written down. Connections to vendors and partners are listed. When monitoring sees something outside the baseline, you can tell quickly.
How to implement it
- Draw one diagram per critical application: components, trust boundaries, and every arrow that crosses a boundary.
- Add the arrows to third parties: payment providers, analytics, support tools, data exports.
- For cloud, export security group and firewall rules and compare them with the intended flows.
- Record expected ports and protocols in a table next to the diagram.
- Review after each significant change and at least once a year.
What a useful baseline contains
A baseline does not have to be a diagram of everything. For each critical application, capture a short table: source, destination, port, protocol, purpose and owner. A web tier that talks to an application tier on one port, which talks to a database on another and to a payment API over HTTPS, is a handful of rows. That table is easy to review, easy to turn into firewall rules and easy to compare with observed traffic.
Using it for detection
Once flows are written down, monitoring has something to compare against. An outbound connection from the database server to the internet, or a new connection from a workstation subnet to a production database, stands out immediately when the expected list is short. Feed the baseline into your network monitoring or cloud flow logs and review exceptions weekly. That connects this outcome to detection work later in the framework.
Third parties and cloud
Partner connections deserve their own section: VPN tunnels, private links, SFTP drops and API integrations. Record the owner, the data exchanged and the contract. In cloud environments, treat security groups, routing tables and peering as the source of truth for what is allowed, and export them regularly so you can show how they changed.
Evidence to collect
- Network and data flow diagrams with a revision date.
- The expected ports and protocols table.
- Firewall or security group exports matched against it.
- Change tickets showing diagram updates.
Common gaps
- The diagram was drawn at launch and nobody has touched it.
- Third party data flows are missing.
- Rules exist in the firewall that no one can explain.
Quick check
Why does this sit under asset management?
Because the flows are part of knowing what you have. They also give detection a baseline, since you cannot spot unusual traffic without a definition of usual.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
