GR:09 validation ~ limiting to authorized source IP addresses

As part of the GR:09 validation , we need to confirm whether there is a policy in place that limits access to authorized source IP addresses. Is this policy part of the LZ ?

If NOT , can Access Context Manager be used to enforce IP address-based access control to restrict incoming traffic based on a predefined set of authorized IP addresses?