Networks security
Networks and network devices are to be secured, managed and controlled so that information in systems and applications is protected.
What the requirement asks
Networks and network devices are to be secured, managed and controlled so that information in systems and applications is protected. Purpose: protect information in networks and the facilities that support it from being compromised through the network. Guidance: implement controls that secure information in networks and protect connected services from unauthorized access, considering: the kinds and classification of information the network can carry; responsibilities and procedures for managing network equipment and devices; current documentation including network diagrams and device configuration files for routers, switches and similar; where suitable, keeping network operations under different responsibility from running ICT systems (5.3); controls protecting the confidentiality and integrity of data over public, third-party or wireless networks and protecting connected systems and applications (5.22, 8.24, 5.14, 6.6), plus measures for availability of network services and connected computers; logging and monitoring that records and detects security-relevant actions (8.15, 8.16); close coordination of network management so service is optimized and controls are applied consistently across the infrastructure; authenticating systems on the network; restricting and filtering system connections, for example with firewalls; detecting, restricting and authenticating equipment and devices connecting to the network; hardening network devices; separating network administration channels from other traffic; being able to isolate critical subnetworks temporarily if the network is attacked; and disabling vulnerable network protocols. Apply suitable security to virtualized networks, including software-defined networking and SD-WAN, which can help by logically separating communications over shared physical networks, especially for distributed systems. Other information: see the ISO/IEC 27033 series and ISO/IEC TS 23167. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
Network security is a set of zones and rules. The guidance asks for the diagram, the rule, the review and the exception.
Status of the guidance. The guidance lens for 8.20 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers and one live sample together.
Evidence an assessor asks for
- Network security managementCurrent network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Network security managementDefined responsibilities and procedures for network device management, separated from system operations where appropriate
- Network security managementFirewall rule sets, network access control configuration and device authentication (for example 802.1X) restricting what can connect
- Network security managementHardening standards for network devices and evidence that insecure protocols are disabled
- Network security managementA segregated management network or out-of-band administration channel
- Network security managementNetwork logs and monitoring coverage, and encryption of data crossing public, third-party or wireless networks
The question an assessor will ask
An assessor will ask for current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers, then trace it to the system it protects. For A.8.20 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- Network diagrams are years out of date
- Management interfaces of network devices are reachable from user networks
- Unknown devices can connect to wired ports without any authentication
- Legacy protocols such as Telnet or SNMPv1 remain enabled
Before the next audit
Before the next audit, check one live sample for this gap: network diagrams are years out of date.