Control A.8.21Security of network services
Security mechanisms, service levels and service requirements of network services must be identified, implemented and monitored.
Network services here means the services the organisation consumes — connectivity, hosting, content delivery, filtering, remote access — whether provided internally or by a supplier.
The control asks for three things to be explicit: the security mechanisms the service provides, the service levels it commits to, and the requirements the organisation has of it. Where the service is bought, those belong in the agreement under A.5.20 and are monitored under A.5.22.
The reason this is separated from A.8.20 is that a network service is frequently a dependency the organisation cannot inspect. What it can do is establish what is promised, verify what is delivered, and know what happens when it is not.
The requirement most often left unstated is what the provider will do during an incident — whether it will assist, how quickly, and whether it will provide the logs an investigation needs.
How to put this in place
You rely on providers for connectivity, DNS, hosting and managed network services, and their weaknesses become yours. Your ISMS needs the security features you depend on written into agreements and checked.
- List your network service providers, including DNS and domain registration.
- Decide which security and availability features you depend on.
- Put them into agreements, with service levels and incident notification.
- Make sure accounts for these services belong to the company, not individuals.
- Review provider performance and reports at least yearly.
Evidence an auditor usually looks for: service agreements with security and service levels, and provider reports or review records.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.