Security of network services
For each network service, the organization is to identify, put in place and monitor the security mechanisms, the service levels and the requirements that apply.
What the requirement asks
For each network service, the organization is to identify, put in place and monitor the security mechanisms, the service levels and the requirements that apply. Purpose: make using network services safe. Guidance: identify and implement the security measures a given service needs, including security features, service levels and requirements, whether it is provided internally or externally, and make sure providers implement them. Determine and regularly monitor each provider's ability to manage the agreed services securely, agree a right to audit, and consider third-party attestations from providers showing they maintain appropriate security. Rules for using networks and network services should cover which networks and services may be accessed; authentication requirements for each service; authorization procedures deciding who may reach which networks and services; management, technical controls and procedures protecting access to network connections and services; the means of access, such as VPN or wireless; the user's time, location and other attributes at access; and monitoring of service use. Security features to consider include the technologies securing the service, such as authentication, encryption and connection controls; the technical parameters needed for a secure connection under the security and connection rules; caching, for example in content delivery networks, with parameters that let users choose caching according to performance, availability and confidentiality needs; and usage procedures that limit who may reach particular services or applications when needed. Network services range from simple unmanaged bandwidth to connections, private network services and managed security services such as firewalls and intrusion detection; ISO/IEC 29146 gives an access management framework. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
Network services carry security requirements. The guidance asks for the service, the requirement, the owner and the assurance.
Status of the guidance. The guidance lens for 8.21 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep service agreements with internal and external network providers specifying security features, service levels and requirements and one live sample together.
Evidence an assessor asks for
- Network service agreementsService agreements with internal and external network providers specifying security features, service levels and requirements
- Network service agreementsRight-to-audit clauses and third-party attestations from network and managed security service providers, with records of review
- Network service agreementsMonitoring reports on provider performance against agreed security and service levels
- Network service agreementsDocumented rules on permitted networks and services, authentication, authorization, means of access (VPN, wireless) and contextual conditions
- Network service agreementsTechnical parameters for secure connections, such as encryption and connection control settings, and caching decisions for CDN services
The question an assessor will ask
An assessor will ask for service agreements with internal and external network providers specifying security features, service levels and requirements, then trace it to the system it protects. For A.8.21 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- Network service contracts specify bandwidth and uptime but no security requirements
- Managed security providers are never audited and attestation reports are not reviewed
- No rules define which networks users may connect to or how
- CDN caching settings expose confidential content
Before the next audit
Before the next audit, check one live sample for this gap: network service contracts specify bandwidth and uptime but no security requirements.