Security of network services

Plain-language summary

Identifying the security features, service levels and requirements you need from every network service — internet links, managed firewalls, VPN, SD-WAN, DNS, managed Wi-Fi — whether bought in or run in-house, then putting them in place and checking they are delivered.

What the clause is really asking

Most organisations do not run their own network services end to end; they buy fibre and LTE links, a managed firewall, a VPN or secure access service, hosted DNS and sometimes the whole network as a managed service. This control asks you to decide what security and service level you need from each, get it in writing, implement the features, and monitor that the provider delivers. Typical requirements: authentication and encryption for remote access; firewall and intrusion-prevention features enabled and kept current; protection against denial-of-service attacks on internet-facing links; who may change configuration and how you are told; logs you can obtain; availability targets and failover; incident notification; and the right to see assurance evidence. The same thinking applies when IT provides the service internally. The common misunderstanding is that the ISP contract covers it — standard terms usually promise a speed and little else. Where the business cannot run without the internet (cloud ERP, cloud MES, card payments), the backup link and how long your network equipment stays powered during an outage are part of this control too.

What auditors look for

Auditors ask for the list of network services and the provider of each, then pick the most critical — usually the primary internet link or the managed firewall — and ask for the contract or SLA and the security features it specifies. They ask how you know the provider meets the SLA: outage reports, monthly service reports, your own monitoring. For a managed firewall they ask who can change rules, whether you are told about changes, and whether you hold your own copy of the configuration. They ask when failover to the backup link was last tested. The hard question: if your provider's network were compromised, how and when would you hear about it?

Typical evidence

Register of network services with provider, criticality and owner; contracts and SLAs specifying security features and service levels; provider assurance evidence (certifications, reports); service performance and outage reports with your review; configuration change notifications from managed providers; remote-access and VPN security settings; failover test records; supplier review records for network providers.

How to comply — recommendations

List every network service — primary and backup internet links, managed firewall, VPN or remote access, DNS, Wi-Fi, links between sites — with its provider and what depends on it. For the critical ones, write a short requirements sheet: MFA and encryption for remote access, security features enabled, change notification, access to logs, availability target, incident notification time, assurance evidence. Check each contract against the sheet and close gaps at renewal. Ask providers for monthly service reports and review them in your supplier meetings. Keep your own copy of managed firewall configurations. Test failover to the backup link twice a year, including on UPS power.

Common nonconformities

No list of network services or their providers; contracts specifying bandwidth but no security features or incident notification; SLAs never monitored; managed firewall changes made by the provider without the organisation's knowledge or record; no copy of provider-held configurations; backup link never tested; remote access without MFA; network providers missing from supplier evaluation.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.