An as-built network is evaluated by analyzing a model of the network by the steps of determining zones within the network, computing the access between zones, summarizing the access between zones to produce a dataset, then inputting a policy set comprising a collection of approvals, typically in the form of simple white-lists of approvals, then comparing the dataset and particularly the access between zones with the policy set of approvals (white-lists) to determine which access fall outside the approvals, and producing therefrom as an output to an end user a report of compliance and noncompliance, and then repeating the steps of determining, computing, and summarizing, and then the comparing step, after a period or after the network has changed. Thus a network operator or auditor can readily and interactively assess whether the infrastructure is in compliance with regulatory or other design requirements.