Networks Security - ISO 27001 Annex A Control
ISO 27001 Annex A 8.20
The network is the connective tissue - if it fails or is compromised, everything else is exposed.
ISO 27001 Annex A 8.20 - Networks Security
Networks carry every interaction between systems and users. The control treats network security as foundational - protecting the network protects everything that runs on it. The scope covers internal LANs, wireless networks, wide-area links, internet connections, and increasingly the mesh of cloud network services and SD-WAN connections that have replaced traditional perimeters.
Practical network security combines defensive design (segmentation, controlled traffic flows, firewalls between zones), authentication (strong access controls for network management), monitoring (visibility into traffic patterns and anomalies), and configuration baselines (consistent secure setup across network devices). Each addresses a different aspect of the overall protection.
The traditional model of a hard outer perimeter with a soft interior has largely given way to zero-trust thinking - assume the network is hostile and verify every connection. Whether the organisation has formally adopted zero trust or not, the principles increasingly apply: identity-aware access, least-privilege traffic flows, and end-to-end encryption rather than relying on network location for security.
The network security gap that bites organisations most often is the legacy connection that escaped the modern controls. A point-to-point link to a partner that does not go through the firewall. A management network that bypasses the access controls. A historic VPN configuration that grants more access than needed. Each is hard to find without a deliberate review of the actual network paths.
Documentation matters because the audit looks at the network as designed and the network as operating. Where the documentation is current and reflects the actual configuration, the audit moves quickly. Where the documentation is incomplete or out of date, the audit slows down and starts asking deeper questions about what else might have drifted.
Practical Compliance Guidance
Network security is described in the IMS1 manual at section 8.3 on IT equipment alongside the wider information security arrangements. Network diagrams and firewall configuration provide the operational evidence.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit covering manual, policies, procedures, registers and audit checklists. |
| PP-8-100 Information Security Policy Procedure | Contains the Information Security Policy including the network security baseline. Use as the source for network governance and the link to access controls. |
Note - all the above files can be downloaded with an alphaZ subscription.
