Segregation of networks

Plain-language summary

Splitting the network into zones by trust level, function or user group — office, servers, guest, plant floor, CCTV and building systems — and controlling what can pass between them, so a compromise in one zone does not reach everything else.

What the clause is really asking

Segregation limits how far an attacker, a worm or a careless mistake can travel. The control asks you to group information services, users and systems and keep the groups apart, with deliberate, controlled connections between them. For a manufacturer or warehouse this is the control that matters most. A flat network puts PLCs, HMIs, SCADA servers, barcode scanners and label printers within reach of every office laptop, and many of those devices run old operating systems that cannot be patched; ransomware that lands through an office email can then stop the line. Proper segregation means separate zones (VLANs or physical networks) with a firewall or access rules between them that allow only the traffic each zone needs; a guest network with no route to internal systems; and remote vendor access to production equipment through a controlled, logged gateway rather than a remote-desktop tool installed on the HMI. The common misunderstanding is that a VLAN alone is segregation — without filtering between VLANs it is only labelling. IEC 62443's zones and conduits give IT and OT teams a shared vocabulary.

What auditors look for

Auditors take the network diagram and ask you to show the zones and the rules between them. They pick a pair — office to production, guest to internal — and ask to see the firewall or access-control rules that govern the traffic. They may ask an engineer to try reaching a PLC or the SCADA server from an office laptop, or check whether the guest Wi-Fi can see internal addresses. They ask how a machine vendor connects remotely to their equipment for support and who approves each session. The hard question: if ransomware hit the accounts PC this morning, which production equipment could it reach?

Typical evidence

Network zoning design or diagram showing zones and permitted flows; firewall or access-control rules between zones with owners and reasons; VLAN configuration; guest network isolation test; inventory of OT and IoT devices by zone; remote vendor access procedure, gateway configuration and session logs; segmentation or penetration test results; review records for inter-zone rules.

How to comply — recommendations

Start with an inventory of what is on the network, grouped by function: office, servers, production equipment, warehouse scanners and printers, CCTV and access control, guest. Make each group a zone and put a firewall between the office and production zones first — that single boundary protects the line from most office-borne threats. Write down the flows each zone needs (the MES server talks to these PLCs on these ports, nothing else) and block the rest. Give vendors one remote-access route into production: a jump host or vendor-access gateway with MFA, approval per session and logging, then remove the remote-desktop tools they installed on HMIs. Test isolation once a year from a laptop in each zone and record the result.

Common nonconformities

Flat network with production equipment, office PCs and guest devices in one address range; VLANs configured but no filtering between them; guest Wi-Fi able to reach internal systems; CCTV and building systems on the corporate network; vendors with uncontrolled remote access to HMIs or PLCs; inter-zone rules never reviewed; segregation never tested.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.