ISO 27001:2022 Annex A Control 8.22

General Guidance on ISO 27001:2022 Annex A 8.22 Compliance

Organisations should strive to achieve equilibrium between operational necessities and security anxieties when instituting network segregation regulations.

ISO 27001:2022 Annex A Control 8.22 provides three recommendations to take into account when setting up network segregation.

How to Separate the Network Into Smaller Sub-Networks

When splitting the network into smaller sub-domains, organisations should consider the sensitivity and importance of each network domain. Depending on this assessment, network sub-domains may be labelled as ‘public domains’, ‘desktop domains’, ‘server domains’, or ‘high-risk systems’.

Organisations should take into account business departments such as HR, marketing, and finance in the process of segmenting their network.

Organisations can also amalgamate these two criteria, assigning network sub-domains into categories such as “server domain linking to the sales department”.

Security Perimeters and Access Control

Organisations must delineate the borders of each network sub-domain explicitly. If there is to be access between two different network domains, this connection should be limited at the perimetric level through the use of gateways like firewalls or filtering routers.

Organisations should evaluate the security needs for each domain when establishing network separation and when granting access through gateways.

This assessment must be conducted in line with the access control policy mandated by ISO 27001:2022 Annex A 5.15, taking into account the following:

• The classification assigned to info assets is on what level.
• The importance of the information is paramount.
• Cost and practicality are major factors when deciding which gateway technology to use.

Wireless Networks

ISO 27001:2022 Annex A 8.22 recommends that organisations observe the following practices when creating network security parameters for wireless networks:

• Evaluate the use of radio coverage adjustment methods to divide wireless networks.
• For delicate networks, organisations can take all wireless access attempts as external connections and forbid access to internal networks until the gateway control gives approval.
• Personnel should only use their own devices in line with the organisation’s policy; the network access provided to personnel and guests should be kept separate.
• Visitors should be subject to the same regulations concerning Wi-Fi use as team members.

Supplementary Guidance on ISO 27001:2022 Annex A 8.22

Organisations should ensure that all business partnerships are subject to appropriate security measures. Annex A 8.22 advises organisations to implement measures to protect their network, IT devices, and other information facilities when engaging with business partners.

Networks that are sensitive can be exposed to a heightened risk of unauthorised access. To protect against this, organisations should take the appropriate steps.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 8.22 replaces ISO 27001:2013 Annex A 13.1.3 in the latest ISO revision.

In comparison to ISO 27001:2013, the ISO 27001:2022 revision necessitates the following of wireless networks:

• If staff abide by the organisation’s policy and only use their own devices, then the wireless network access provided for personnel and visitors should be kept separate.
• Guests should be subject to the same restrictions and controls concerning Wi-Fi as personnel.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

ISMS.Online facilitates you to:

• Document processes easily with this user-friendly interface. No software installation is required on your computer or network.
• Streamline your risk evaluation procedure by automating it.
• Achieve compliance with ease by using online reports and checklists.
• Maintain a record of your progression as you work towards certification.

ISMS.online provides a comprehensive set of functionalities to aid organisations and businesses in meeting the industry ISO 27002 and/or ISO 27001:2022 ISMS standard.

Get in touch with us to organise a demonstration.