Networks security

Plain-language summary

Securing, managing and controlling your networks and network devices — firewalls, switches, routers, wireless — so that the information moving across them and the systems connected to them are protected, including the plant-floor equipment that often shares the office network.

What the clause is really asking

This is the general network control: it asks you to protect the network as a whole and the devices that run it. In practice that means knowing what your network looks like (a current diagram showing zones, internet links, remote access and wireless); assigning responsibility for network devices; hardening them (default passwords changed, firmware current, unused ports and services disabled, management interfaces reachable only from an admin network); controlling and reviewing firewall rules; authenticating the users and devices that connect, wireless included; and logging and monitoring traffic and device changes. For manufacturing and warehousing the real exposure is usually the flat network: PLCs, HMIs, barcode scanners, label printers and CCTV sitting on the same address range as the office PCs that receive phishing emails. Many of those devices cannot be patched or run security software, so the network around them is their protection — which is why this control, 8.21 and above all 8.22 belong together. The common misunderstanding is that a firewall at the internet edge equals network security; most damage happens inside the perimeter.

What auditors look for

Auditors ask for the network diagram and check whether it is current by walking a comms room or asking where a specific device sits. They pull the firewall rule base and look for 'any-any' rules, rules with no owner or reason, and the date of the last review. They ask who can log in to switches and firewalls, how, and whether default credentials remain. On a plant they ask which network the production equipment is on and whether a laptop plugged into a spare port on the shop floor would reach the server room. The hard question: show me the last firewall rule review and what you removed.

Typical evidence

Current network diagram with zones, internet links and remote-access connections; network device inventory with owners and firmware versions; device hardening baseline; firewall rule base with rule owners and documented reviews; admin access list for network devices with MFA; wireless security configuration; network logs and monitoring alerts; change records for network device changes.

How to comply — recommendations

Draw the network as it is today — one page showing zones, links, remote access, wireless and where the production equipment sits — and keep it under document control. Build a device inventory and a short hardening baseline: default passwords changed, firmware current, unused ports and services off, management only from an admin network or jump host. Review firewall rules twice a year; every rule needs an owner and a reason, and stale ones go. Use enterprise wireless security with individual credentials or certificates for staff, and a separate guest network. Send firewall and switch logs to a central place and alert on admin logins and configuration changes. Route network changes through change management.

Common nonconformities

No network diagram, or one years out of date; firewall rules with no owner, reason or review; permissive 'any-any' rules; default credentials on switches or wireless access points; network device firmware unpatched for years; production equipment on the office network with no separation; shared admin accounts on network devices; network logs not collected or never reviewed.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.