"Networks and network devices shall be secured, managed and controlled to protect information in systems and applications."[1]

The organization should maintain network diagrams to document it's networks. The network maps should also define the networks classification (the level sensitive data it can transmit). It should also backup network device configurations. Responsibilities for the maintained of network equipment should be established as well as audit logging.