Control A.8.22Segregation of networks
Groups of information services, users and information systems must be segregated in the organisation’s networks.
Segregation limits how far an intrusion travels, and it is the control that most often determines whether an incident is contained or total. A flat network converts one compromised endpoint into access to everything that endpoint can reach.
Segregation follows classification and function: separating environments from each other, separating systems of different sensitivity, separating user populations, and isolating things that cannot be protected any other way — legacy systems, operational technology, third-party connections and guest access.
Implementation is no longer only physical or VLAN-based; identity-aware and software-defined approaches achieve the same objective differently. The control is about the outcome.
The practical test is the one worth running: from a standard user device, what can be reached? Most organisations find the answer is broader than the design intended, because exceptions were added to solve problems and never withdrawn.
How to put this in place
On a flat network, one compromised device can reach everything. Your ISMS needs groups of systems kept apart by trust and purpose, so a problem in one area stays there.
- Decide the segments you need, for example guests, corporate, production, development and management.
- Design the traffic rules allowed between them, denying by default.
- Implement them in physical, virtual and cloud networks, and log traffic between segments.
- Test that guests and low-trust areas cannot reach internal systems.
- Test rule changes before they go live, so a convenient exception does not reopen a path.
Evidence an auditor usually looks for: network design showing segments, rules between segments, and test results showing guests cannot reach internal systems.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.