Does your organization maintain documentation of expected network ports, protocols, and services used among authorized systems?

This documentation serves as a baseline for normal network activity, allowing security teams to identify unauthorized or suspicious communications. It should include details such as port numbers, protocols (TCP/UDP), services (HTTP, SSH, etc.), and the systems that legitimately use them.

An acceptable deliverable would be a network communications matrix or spreadsheet that lists all authorized systems, the ports and protocols they use to communicate, the services running on those ports, and the business justification for each communication path. This document should be regularly reviewed and updated as the network environment changes.