The Compliance Blind Spot Hiding in Plain Sight: Why Auditors Must Start Taking ARP Seriously

Compliance frameworks are built on the assumption that if a control is documented, tested, and audited, the environment it governs is reasonably secure. For most of the protocols operating above Layer 3, that logic holds reasonably well. Firewalls get reviewed. Encryption standards get tested. Access controls get sampled. But beneath all of that scrutiny, Address Resolution Protocol operates largely in the dark—unaudited, ungoverned, and in many enterprise environments, entirely unacknowledged in the compliance record.

That omission is not a minor administrative oversight. It is a structural gap in how organizations demonstrate security assurance, and it carries real consequences for both their risk posture and their regulatory defensibility.

Why Compliance Frameworks Stop Short of Layer 2

To understand why ARP escapes audit attention, it helps to examine how major frameworks were originally constructed. SOC 2, developed by the American Institute of Certified Public Accountants, evaluates controls around the Trust Services Criteria—availability, confidentiality, processing integrity, and security. Its control objectives are written at a level of abstraction that maps most naturally to application-layer and network-perimeter controls. The framework asks whether data is encrypted in transit, whether access is appropriately restricted, whether logging is sufficient. It does not ask whether ARP responses on a given subnet are validated.

ISO 27001 takes a risk-based approach that, in theory, could capture Layer 2 threats. Annex A includes controls related to network security and information transfer. In practice, however, most ISO 27001 implementations interpret "network security" to mean perimeter firewalls, intrusion detection systems, and VPN configurations. The internal broadcast domain—where ARP operates—rarely appears in the Statement of Applicability with any meaningful specificity.

HIPAA's Security Rule, which governs the protection of electronic protected health information, focuses on administrative, physical, and technical safeguards. Technical safeguard requirements address access controls, audit controls, and transmission security. Like the other frameworks, the rule was written with application-layer threats in mind. ARP poisoning, gratuitous ARP abuse, and dynamic ARP inspection gaps do not appear anywhere in the regulatory text.

The result is predictable: auditors follow the frameworks, the frameworks omit Layer 2, and ARP never gets examined.

What That Omission Actually Costs Organizations

The argument for ignoring ARP might seem defensible on paper—if the frameworks don't require it, why invest in auditing it? That reasoning collapses when you consider what ARP manipulation actually enables.

An attacker who successfully poisons an ARP cache on a production network can intercept traffic between hosts without triggering firewall alerts, because the traffic never reaches the firewall. Encryption at Layer 7 offers partial protection, but only for sessions where certificate validation is enforced. In mixed environments—particularly those running legacy systems or IoT devices—many internal communications remain unencrypted and fully exposed to a man-in-the-middle positioned at Layer 2.

In healthcare environments subject to HIPAA, this means that ePHI traversing an internal network segment could be intercepted and read without any of the technical safeguards the Security Rule was designed to protect. In environments undergoing SOC 2 audits, the confidentiality criterion could be violated by a Layer 2 attack that leaves no trace in the logging infrastructure being reviewed. The compliance attestation would be accurate on its face while describing an environment that is genuinely insecure.

This is not a theoretical concern. Internal threat actors and lateral-movement scenarios in ransomware deployments frequently leverage ARP-based techniques precisely because they are reliable, difficult to detect with conventional tooling, and invisible to compliance-oriented monitoring.

Building a Defensible ARP Governance Strategy

Closing this gap does not require rewriting compliance frameworks or convincing an auditor to expand their scope mid-engagement. It requires that IT security teams take ownership of Layer 2 governance and document it in a way that integrates with existing compliance structures.

The starting point is visibility. Organizations cannot govern what they cannot see. Deploying monitoring that captures ARP traffic patterns across internal segments—flagging anomalies such as unexpected ARP reply volumes, IP-to-MAC binding changes, and gratuitous ARP broadcasts from non-authoritative sources—establishes the baseline evidence that auditors expect when reviewing any control domain. Without this telemetry, there is no audit trail, and without an audit trail, there is no compliance.

The second component is enforcement. Dynamic ARP Inspection, available on most enterprise-grade managed switches, validates ARP packets against a trusted DHCP snooping binding table before forwarding them. Enabling DAI on production VLANs is a concrete, documentable control that directly mitigates ARP spoofing risk. Security teams that have deployed DAI and can demonstrate its configuration, scope, and testing history are in a substantially stronger position during an audit than those relying solely on perimeter controls.

The third component is documentation. Existing compliance frameworks may not explicitly call for ARP controls, but they universally require that organizations identify and address risks appropriate to their environment. A risk register that acknowledges Layer 2 threats, documents the organization's exposure, and records the mitigating controls in place satisfies the intent of frameworks like ISO 27001 even when the specific control is not enumerated in Annex A. Security teams that have completed structured training in ARP protocol behavior are better equipped to write this documentation accurately and defend it under audit scrutiny.

The Auditor's Expanding Responsibility

There is also a reasonable argument to be made that auditors themselves need to evolve. As enterprise networks become more complex—spanning on-premises infrastructure, cloud-connected segments, and hybrid environments where Layer 2 boundaries are increasingly blurred—the assumption that perimeter controls are sufficient is becoming harder to sustain.

Forward-looking audit practices are beginning to incorporate network architecture reviews that go deeper than firewall rule sets. Auditors who understand the threat model associated with ARP manipulation are better positioned to ask the right questions: Are ARP responses validated on production segments? Is there a process for detecting unexpected MAC-to-IP binding changes? Has the organization tested its detection capability against ARP-based attack scenarios?

Those questions may not yet appear on standard audit checklists. But the organizations that can answer them confidently—and document that capability—will be better prepared as regulatory expectations continue to mature.

Credential-Backed Protocol Knowledge as a Compliance Asset

For IT security professionals, the practical implication is clear. Understanding ARP at a protocol level is no longer a niche technical skill reserved for network engineers. It is foundational knowledge for anyone responsible for maintaining a defensible compliance posture. The ability to identify ARP-based attack vectors, configure appropriate mitigations, and articulate that knowledge in the language of audit and governance documentation is a capability that directly supports organizational risk management.

Structured credentialing programs that emphasize ARP behavior, detection, and control provide professionals with the vocabulary and technical depth needed to bridge the gap between protocol-level security and compliance-level documentation. That bridge is where the most significant work remains to be done—and where the most consequential improvements to enterprise security posture are still waiting to be made.

The compliance frameworks will eventually catch up. The organizations that build ARP governance into their security programs now will not be caught scrambling when they do.