ISO 27001 A.8.22 - Segregation of Networks

Requirement

“Groups of information services, users and information systems shall be segregated in the organization’s networks.”

Plain-language meaning

Large flat networks are hard to defend. Network segregation divides users, systems, and services into smaller physical or logical zones so traffic between them can be controlled.

Segregation can use firewalls, VLANs, routing controls, security groups, wireless network separation, identity-aware access, or other logical boundaries.

Why this matters

If everything can talk to everything, one compromised endpoint can become a path to servers, databases, admin interfaces, backup systems, and sensitive services. Segregation reduces attack spread, limits unauthorized access, and makes monitoring more meaningful.

Segregation is not only about the internet perimeter. Internal business units, environments, wireless networks, administration networks, cloud networks, and sensitive systems may also need separation.

Implementation guidance

1. Define network zones

Use business analysis, architecture modelling, and Risk Assessment to define zones such as user network, server network, production, development, guest wireless, payment systems, management network, backup network, internet-facing services, and cloud environments.

2. Document zone relationships

Document which systems and network devices belong to each zone, what traffic is allowed between zones, who owns each zone, and what security level applies.

3. Control connections between zones

Use gateways, firewalls, routing restrictions, ACLs, security groups, and monitoring to control connections. Rules should be specific, justified, approved, and reviewed.

4. Include wireless networks

Wireless networks need risk assessment. Direct connection from wireless to the main network should be justified and protected using known good security standards.

5. Watch for performance-driven bypasses

Operational teams may weaken segregation for performance, convenience, troubleshooting, or legacy support. Such changes need security review and approval.

Audit guidance

Auditors should verify:

• network zones are defined and documented;
• zones match business and security requirements;
• systems, services, users, and network devices are assigned to zones;
• connections between zones are controlled;
• firewall, routing, ACL, and security group rules match the design;
• wireless network access to main networks is risk-assessed;
• performance changes have not weakened segregation;
• zone performance and availability are monitored where restrictions could affect service;
• exceptions are approved and reviewed.

The auditor should not assume that a diagram proves segregation. Sample actual configurations and, where appropriate, test connectivity.

Evidence examples

Strong evidence

• Network zones are defined from risk and architecture.
• Systems and services are assigned to zones.
• Inter-zone rules are justified, specific, and reviewed.
• Wireless networks are segregated or risk-assessed.
• Segmentation tests prove blocked and allowed paths.
• Performance-driven exceptions are documented and approved.

Weak evidence

• Flat network with informal access assumptions.
• Zones exist in diagrams but not in firewall/routing rules.
• Broad “any-any” rules between zones.
• Guest wireless can reach internal systems.
• Performance fixes bypass security controls without review.
• Cloud security groups are not included in segregation review.

Common failures

Exam traps

Related controls and concepts

• A.8 Technological Controls MOC
• A.8.20 Networks Security
• A.8.21 Security of Network Services
• A.8.9 Configuration Management
• A.8.16 Monitoring Activities
• A.5.15 Access Control
• Risk Assessment
• Statement of Applicability
• Network Security Architecture and Zoning Standard
• Network Zone and Connection Matrix
• Network Segmentation Test Checklist
• Wireless Network Security Assessment
• A.8.22 Audit Evidence Pack
• A.8.22 Audit Checklist

KB-ready summary

• Define network zones from business and risk.
• Document systems, users, services, and allowed flows per zone.
• Enforce zone boundaries technically.
• Include wireless, cloud, management, and sensitive networks.
• Test and review segregation regularly.

Templates and checklists

• Network Zone and Connection Matrix
• Network Segmentation Test Checklist
• Wireless Network Security Assessment
• A.8.22 Audit Checklist