ISO 27001:2022 Annex A 8.22 – Segregation of Networks

• See ISO 27002:2022 Control 8.22 for more information.
• See ISO 27001:2013 Annex A 13.1.3 for more information.

ISO 27001 Annex A 8.22: Strengthening Security Through Network Segregation

When cyber-criminals infiltrate computing systems, services or devices, they don’t restrict themselves to those assets alone.

They make use of the first infiltration to penetrate a company’s whole network, obtain access to sensitive data, or to perform ransomware attacks.

Cyber crooks could pilfer the login details of HR staff at a hospital after a successful phishing attack, affording them access to HR systems.

Using their access point, the attackers can traverse the network and uncover networks containing confidential patient data. This intrusion could lead to the loss of data, cause disruption to operations, or even open the door to a ransomware attack.

The hospital could prevent unauthorised access to confidential data and reduce the consequences of a breach by using network segmentation techniques such as firewalls, virtual networks, or server isolation.

ISO 27001:2022 Annex A 8.22 outlines how companies can apply and preserve suitable network segregation methods to avert risks to the availability, integrity, and confidentiality of information assets.

Purpose of ISO 27001:2022 Annex A 8.22

ISO 27001:2022 Annex A 8.22 allows organisations to divide their IT networks into sub-networks dependent on the degree of sensitivity and importance, and to limit the transmission of information between those different sub-networks.

Organisations can use this to stop malware and viruses from travelling from infected networks to those containing sensitive data.

This guarantees that organisations secure the confidentiality, integrity and accessibility of data assets stored on essential sub-networks.

Ownership of Annex A 8.22

The Information Security Officer should be held accountable for adhering to ISO 27001:2022 Annex A 8.22, which requires the segmentation of networks, devices and systems according to risks and the application of network segregation techniques and procedures.

General Guidance on ISO 27001:2022 Annex A 8.22 Compliance

Organisations should strive to achieve equilibrium between operational necessities and security anxieties when instituting network segregation regulations.

ISO 27001:2022 Annex A Control 8.22 provides three recommendations to take into account when setting up network segregation.

How to Separate the Network Into Smaller Sub-Networks

When splitting the network into smaller sub-domains, organisations should consider the sensitivity and importance of each network domain. Depending on this assessment, network sub-domains may be labelled as ‘public domains’, ‘desktop domains’, ‘server domains’, or ‘high-risk systems’.

Organisations should take into account business departments such as HR, marketing, and finance in the process of segmenting their network.

Organisations can also amalgamate these two criteria, assigning network sub-domains into categories such as “server domain linking to the sales department”.

Security Perimeters and Access Control

Organisations must delineate the borders of each network sub-domain explicitly. If there is to be access between two different network domains, this connection should be limited at the perimetric level through the use of gateways like firewalls or filtering routers.

Organisations should evaluate the security needs for each domain when establishing network separation and when granting access through gateways.

This assessment must be conducted in line with the access control policy mandated by ISO 27001:2022 Annex A 5.15, taking into account the following:

• The classification assigned to info assets is on what level.
• The importance of the information is paramount.
• Cost and practicality are major factors when deciding which gateway technology to use.

Wireless Networks

ISO 27001:2022 Annex A 8.22 recommends that organisations observe the following practices when creating network security parameters for wireless networks:

• Evaluate the use of radio coverage adjustment methods to divide wireless networks.
• For delicate networks, organisations can take all wireless access attempts as external connections and forbid access to internal networks until the gateway control gives approval.
• Personnel should only use their own devices in line with the organisation’s policy; the network access provided to personnel and guests should be kept separate.
• Visitors should be subject to the same regulations concerning Wi-Fi use as team members.

Supplementary Guidance on ISO 27001:2022 Annex A 8.22

Organisations should ensure that all business partnerships are subject to appropriate security measures. Annex A 8.22 advises organisations to implement measures to protect their network, IT devices, and other information facilities when engaging with business partners.

Networks that are sensitive can be exposed to a heightened risk of unauthorised access. To protect against this, organisations should take the appropriate steps.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 8.22 replaces ISO 27001:2013 Annex A 13.1.3 in the latest ISO revision.

In comparison to ISO 27001:2013, the ISO 27001:2022 revision necessitates the following of wireless networks:

• If staff abide by the organisation’s policy and only use their own devices, then the wireless network access provided for personnel and visitors should be kept separate.
• Guests should be subject to the same restrictions and controls concerning Wi-Fi as personnel.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

ISMS.Online facilitates you to:

• Document processes easily with this user-friendly interface. No software installation is required on your computer or network.
• Streamline your risk evaluation procedure by automating it.
• Achieve compliance with ease by using online reports and checklists.
• Maintain a record of your progression as you work towards certification.

ISMS.online provides a comprehensive set of functionalities to aid organisations and businesses in meeting the industry ISO 27002 and/or ISO 27001:2022 ISMS standard.

Get in touch with us to organise a demonstration.