This question is almost too broad to be on-topic here.
Layer-1 is the physical layer, your first defense. Using conduit or ducting is a layer-1 defense, as well as a policy which requires any switch ports that are not currently used to be disabled, ensuring that unused network cables are not cross-connected in the data closet, and limiting access to data closets and other area where the physical network is exposed.
If you want a standard for layer-2 authentication, it's 802.1X, although it is becoming easier by the day to bypass it (see Bridge Too Far), and 802.1AE, which extends 802.1X with MKA (MACsec Key Agreement) for authentication and encryption. There are entire books (e.g. from Cisco Press: LAN Switch Security: What Hackers Know About Your Switches, by Eric Vyncke, Christopher Paggen) about LAN security. Port security on switches can be set up to only allow a single (or limited number of) MAC address at any given time, or in any given time period, to prevent connection of hubs, switches, APs, etc., including a port disable (requiring manual intervention or for a given time period) if violations are detected (care needs to be taken for things like VoIP phones where PCs are connected to the phone since the phone itself will have one or more MAC addresses). Disable most layer-2 protocols (e.g. CDP/LLDP, DTP, PAgP/LACP, VTP, etc.) since they are vulnerable to attack. Specifically limit VLANs on trunks (manually prune VLANs). Use DHCP Snooping in conjunction with Dynamic ARP Inspection and IP Source Guard. And much, much more.
For a layer-3, standards-based solution, which can be used alone or combined with others, IPsec was developed for IPv6, but later retrofitted to include both IPv4 and IPv6 in RFC 1825, Security Architecture for the Internet Protocol and its replacements, RFC 2401 and RFC 4301, and various extension and modification RFCs.
Beyond layer-3, you get into a bunch of application-layer authentication methods (e.g. SSL), but you only asked about security up to layer-3, and applications and application-layer protocols are off-topic here.
Security should use a layered approach, and you need to balance the cost (not only direct cost, but other factors, e.g. time, business disruption, etc., too) to the level of risk you are willing to tolerate. Determine if the cost to implement a security method, and compare it to the risk involved. You will never be 100% secure, but you can make it so difficult that only the most determined intruders will get it, so you try to make it not worth their time and efforts. For example, would you go to great time and effort to break into a network to get a simple calculator application, even if it is much better than the Windows calculator? It may be worth it if the calculator has a proprietary calculation that is worth millions of dollars.
Auditors will often be satisfied that you have identified and rated a security risk, but you have not remediated it, if you can show that the remediation is more expensive than the risk involved. For example (don't depend on this if you are really building), building in a 100-year flood plain, where there is a 1% chance (each year) that that a flood will destroy your building, you don't need flood insurance, while building in a 10-year flood plain, where there is a 10% chance (each year) that a flood will destroy your building, requires flood insurance. Something like an almost bullet-proof physical security can mitigate the need for advanced layer-2 security (e.g. 802.1x), if the cost for implementing the layer-2 security is high (e.g. 802.1x requires an infrastructure, and it is often disruptive to the business).