Networks security
Purpose
Secure and manage networks and network devices to protect the information flowing through systems and applications.
How to meet this control
In short: Secure and manage networks to protect information.
- Step 01Keep current network diagrams and device configuration backups, and assign clear ownership of network management
- Step 02Deploy firewalls and cloud security groups with documented, least-privilege rules and a periodic rule review to remove stale entries
- Step 03Encrypt traffic crossing public, wireless or third-party networks using TLS or VPN tunnels
- Step 04Harden network devices, change default credentials, disable vulnerable protocols and keep firmware patched
- Step 05Separate the network management plane from normal user traffic and authenticate connecting systems
- Step 06Log and monitor network activity and retain the ability to isolate subnetworks if the network is attacked
Tip: Firewalls/security groups with documented, reviewed rules.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Define management responsibilities and procedures and keep diagrams and config files current
- ›Where sensible, separate operational responsibility for networks from broader ICT operations
- ›Apply controls that protect data crossing public, third-party or wireless networks
- ›Log and monitor network activity that affects security and authenticate connecting systems
- ›Restrict and filter connections using firewalls and detect devices joining the network
- ›Harden network devices and disable vulnerable network protocols
- ›Keep network administration channels separate from normal traffic
- ›Be able to isolate critical subnetworks if the network is under attack
Audit evidence to keep
- - Current network diagram and device configuration backups
- - Firewall or security group ruleset with evidence of periodic review
- - Configuration showing encryption on external or wireless links
- - Network device hardening standard and patch status
- - Network activity logs feeding the monitoring platform
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.8.20. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.