ISO 27001 A.8.20 - Networks Security

Requirement

“Networks and network devices shall be secured, managed and controlled to protect information in systems and applications.”

Plain-language meaning

Networks are not just cables and routers. They are trust paths between users, systems, applications, cloud services, suppliers, and management interfaces. If the network is poorly designed or poorly controlled, attackers can move, intercept, disrupt, or modify information.

Network security should be considered during design, implementation, operation, monitoring, problem management, and change control.

Why this matters

Networks are complex and easy to misconfigure. A weak firewall rule, exposed management interface, badly protected administrative network, unmanaged virtual network, or forgotten disaster recovery link can bypass the intended architecture.

The control protects confidentiality, integrity, and availability by making network architecture, devices, traffic flows, zoning, remote administration, monitoring, encryption, routing, and access control deliberate and documented.

Implementation guidance

1. Define network architecture and zones

Document network topology, zones, trust boundaries, sensitive traffic paths, internet exposure, supplier connections, administrative networks, backup networks, and disaster recovery links.

2. Secure network devices

Routers, switches, firewalls, wireless controllers, load balancers, VPN gateways, SD-WAN devices, and virtual network components should have secure configuration, restricted administration, logging, monitoring, patching, backup, and change control.

3. Control traffic and routing

Use routing restrictions, firewall rules, access control lists, segmentation, and network access controls to limit traffic to business need. Avoid flat networks unless risk assessment justifies them.

4. Protect traffic over public or untrusted networks

Where confidentiality or integrity matters, use appropriate encryption, VPN, secure protocols, certificate management, or equivalent controls.

5. Include virtual and cloud networks

Virtual networks, hypervisors, cloud networking, security groups, route tables, private links, and management planes should be treated as network security scope. Virtual architecture can bypass physical network assumptions.

6. Monitor and record network activity

Network monitoring should detect faults, suspicious traffic, policy violations, and security events. Faults, problems, corrective actions, and security alerts should be recorded and linked to A.8.16 Monitoring Activities and incident reporting.

Audit guidance

Auditors should verify:

• network topology and operating environments are documented;
• sensitive traffic and exposed network areas are identified;
• network zones and trust boundaries are defined and enforced;
• public network use is protected appropriately;
• network devices are securely configured and access-controlled;
• remote administration is controlled and logged;
• network changes are authorized and documented;
• virtual networks, hypervisors, cloud networking, backup networks, and administrative networks are included;
• monitoring detects faults and potential breaches;
• incidents and problems are reported and corrected;
• internal or external network security expertise is adequate for complexity.

Auditors should look for bypass paths. Administrative networks, backup links, emergency routes, hypervisor layers, and disaster recovery connections often escape normal review.

Evidence examples

Strong evidence

• Diagrams match actual network configuration.
• Sensitive traffic paths are identified and protected.
• Administrative and management networks are tightly controlled.
• Firewall and route rules are reviewed and justified.
• Virtual/cloud network controls are included in scope.
• Network device access is restricted, logged, and reviewed.
• Monitoring records lead to incident or corrective action where needed.

Weak evidence

• Network diagram exists but is stale.
• Flat network with no risk justification.
• Firewall rules are broad and not reviewed.
• Network device admin access is shared or unmanaged.
• Virtual/cloud networks are considered outside network scope.
• Backup or disaster recovery links bypass zoning.
• Monitoring detects faults but security events are not escalated.

Common failures

Exam traps

Related controls and concepts

• A.8 Technological Controls MOC
• A.8.9 Configuration Management
• A.8.15 Logging
• A.8.16 Monitoring Activities
• A.8.20 Audit Evidence Pack
• A.8.20 Audit Checklist
• A.5.15 Access Control
• A.5.26 Response to Information Security Incidents
• A.5.37 Documented Operating Procedures
• Risk Assessment
• Statement of Applicability
• Network Security Architecture and Zoning Standard
• Network Device Configuration and Change Review
• Network Monitoring and Corrective Action Register
• Virtual Network and Hypervisor Security Review

KB-ready summary

• Document topology, zones, trust boundaries, and sensitive routes.
• Secure and restrict network device administration.
• Control routing, segmentation, and public network exposure.
• Include virtual, cloud, administrative, backup, and DR networks.
• Monitor faults and suspicious activity.
• Keep network changes documented and reviewed.

Templates and checklists

• Network Security Architecture and Zoning Standard
• Network Device Configuration and Change Review
• Network Monitoring and Corrective Action Register
• Virtual Network and Hypervisor Security Review
• A.8.20 Audit Checklist