Control A.8.20Networks security
Networks and network devices must be secured, managed and controlled to protect information in systems and applications.
The parent network control, covering the network as a managed thing: how it is designed, how its devices are configured and maintained, how it is monitored, and how access to manage it is controlled.
Network device configuration is where A.8.9 applies most consequentially. Firewalls and routers accumulate rules over years, each added for a reason nobody recorded, and an unreviewed rule base is a permission set nobody can justify — which is the network equivalent of the access accumulation A.5.18 addresses.
The management plane deserves separate attention. Administrative access to network devices is privileged access under A.8.2, and a management interface reachable from the general network removes much of the value of the segregation in A.8.22.
The perimeter is no longer where the control mainly applies, which is why A.8.21, A.8.22 and A.8.23 exist alongside it.
How to put this in place
Networks carry nearly all your information, and poorly understood rules or exposed management interfaces give attackers an easy way in. Your ISMS needs a current picture of the network and controlled traffic at its boundaries.
- Draw and maintain network diagrams, including cloud networks.
- Set a standard for managing network devices: administrator access, updates and configuration backups.
- Define boundary filtering and give each firewall or security group rule an owner and a reason.
- Close management ports that are reachable from the internet.
- Review rules and device configurations on a schedule.
Evidence an auditor usually looks for: network diagrams, firewall and security group rules with review records, and device configuration standards.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.