ISO 27001 Segregation of Networks Explained – Control 8.22

ISO 27001 Segregation of Networks Explained – Control 8.22

/ ISO 27001 Controls / By

Once an attacker gets a foothold in your network, they do not stop at a single system. They move sideways until they find your core databases, domain controllers, or financial tools, unless the network stops them. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses rely on a flat network architecture where a single compromised Wi-Fi printer or guest laptop gives hackers complete, unmonitored access to the entire company. Flat networks turn minor incidents into business-ending catastrophes.

ISO 27001:2022 includes Annex A 8.22 to make sure you contain impact by default. This control ensures your business divides networks into distinct, controlled domains, restricting lateral movement and protecting sensitive data even when a perimeter breach occurs.

Quick Summary: What ISO 27001 Annex A 8.22 Requires

At a practical level, Annex A 8.22 is about stopping the spread of an attack. It does not require you to deploy complex micro-segmentation across every single device if your risk level does not justify it. Here is what you need to do in plain English:

  • Divide Networks into Domains: Separate your network into logical or physical sub-networks based on purpose, user roles, and data risk.
  • Block Unnecessary Network Traffic: Apply strict firewall rules and access control lists (ACLs) so sub-networks only talk to authorized systems.
  • Isolate Wireless Networks: Treat all wireless connections—especially guest Wi-Fi—as untrusted external networks by default.
  • Lock Down Third-Party Access: Segregate vendor, partner, and contractor connections so they cannot wander across your internal network.
  • Prevent Unauthorized Network Bridging: Stop dual-homed devices or unauthorized routers from bypassing your boundary firewalls.
  • Maintain Network Diagrams: Keep clear, updated network maps and firewall rule documentation to prove your boundaries work.

Why Flat Networks Are a Major Security Hazard

A flat network architecture assumes that everything inside the perimeter firewall is entirely trustworthy. In modern cybersecurity, that assumption is dead. If malware or ransomware infects an endpoint on an unsegregated network, it will automatically scan, pivot, and spread laterally across your business in minutes.

Failing to segregate networks exposes your organisation to severe hazards:

  • Rapid Ransomware Spread: A single infected laptop automatically encrypting shared network drives, backups, and server hosts.
  • Lateral Movement by Attackers: Hackers exploiting low-risk systems (like IoT devices) to pivot into sensitive production databases.
  • Excessive Privileged Access: Internal staff or third-party users accessing high-value administrative interfaces they have no business touching.
  • Uncontrolled Guest Access: Visitors or contractors plugging into office ports and viewing internal corporate traffic.

My 10 Step Plan to Implement Annex A 8.22 Fast

You do not need an unmanageable mesh of firewalls to satisfy an ISO 27001 auditor. Here is my pragmatic, 10-step plan to establish audit-ready network segregation across your business.

1. Identify Your Network Domains

Divide your overall network infrastructure into clear, functional zones based on business purpose and risk level. Typical domains include:

  • User and workstation subnets (desktop computers, laptops, local printers).
  • Server and data storage zones (core databases, application servers, active directory).
  • Management and administrative networks (out-of-band management interfaces, hypervisors).
  • Public-facing zones (DMZs hosting web servers, public APIs, mail gateways).
  • Guest and visitor networks.

2. Classify Domains by Information Risk

Evaluate the sensitivity of the data residing inside each network domain (Annex A 5.12). Assign stricter isolation to high-risk zones:

  • Apply maximum isolation to networks hosting customer personal data, financial systems, or trade secrets.
  • Restrict traffic heavily into infrastructure management subnets.
  • Isolate low-trust zones (like IoT devices or smart building systems) away from corporate assets.

3. Enforce “Deny All” Firewall Rules at Boundaries

Traffic moving between network subnets must be restricted explicitly. Set up filtering firewalls, gateways, or cloud security groups that enforce strict rules:

  • Configure boundary rules to block all traffic by default (“Deny All”).
  • Explicitly allow only required IP addresses, ports, and protocols needed for daily operations.
  • Remove legacy, overly permissive “Any-to-Any” routing rules.

4. Enforce Boundary Access Controls

Network boundary controls must verify identity, context, and purpose before allowing traffic to cross between domains:

  • Enforce network access control (NAC) to verify device health before granting connection rights.
  • Require multi-factor authentication (MFA) and encrypted VPNs/zero-trust gateways for users jumping into administrative zones.
  • Implement web application firewalls (WAFs) to inspect traffic entering public-facing DMZs.

5. Explicitly Segregate Wireless Networks

Wireless access is one of the easiest ways for unauthorized devices to reach internal assets. Treat wireless networks as untrusted by default:

  • Completely isolate guest Wi-Fi networks from corporate systems, allowing internet access only.
  • Separate corporate wireless traffic using dedicated SSIDs, VLANs, and 802.1X authentication.
  • Require corporate wireless devices to pass through a filtering gateway before reaching internal server subnets.

6. Isolate Third-Party and Vendor Connections

Connections provided to external suppliers, managed service providers (MSPs), or partners must never have open access to your network:

  • Terminate third-party VPNs inside dedicated, isolated landing zones.
  • Restrict vendor access strictly to the single target system or service required for their contract.
  • Monitor and log all third-party network sessions continuously (Annex A 8.16).

7. Prevent Unauthorized Network Bridging

Prevent users or hardware setups from accidentally or intentionally bridging segregated network domains:

  • Disable dual-homing (devices connected to two distinct networks simultaneously, such as Wi-Fi and Ethernet).
  • Block unauthorized routing, tunneling tools, or rogue personal Wi-Fi access points.
  • Disable unused physical Ethernet ports in office spaces to prevent unauthorized physical connections.

8. Document Network Segregation Architecture

If your network architecture exists only in an engineer’s memory, it will fail during an audit or an incident response. Keep explicit records:

  • Maintain detailed network topology diagrams showing domain boundaries, firewalls, and gateways.
  • Document the business justification for every open port and inter-domain routing rule.
  • Keep rule sets organized inside your central configuration management system (Annex A 8.9).

9. Review Segregation After Major System Changes

Networks drift over time as new servers, cloud resources, and software integrations are added. Keep boundaries tight through routine checks:

  • Review firewall rule sets and routing tables at least twice a year to prune obsolete rules.
  • Re-verify network boundaries after major cloud migrations, office moves, or infrastructure upgrades (Annex A 8.32).
  • Conduct routine internal port scans to confirm blocked boundaries remain non-routable.

10. Conduct Routine Vulnerability Scans and Audits

Verify that your network boundaries are working in practice by testing them like an attacker would:

  • Perform internal penetration tests to attempt lateral movement from user subnets to server zones.
  • Scan boundary firewalls to detect misconfigurations or unintended exposed ports.
  • Audit network logs regularly to catch unauthorized connection attempts between domains.

Common Implementation Pitfalls and How to Fix Them

When preparing clients for ISO 27001 audits, I frequently spot the same network segregation mistakes. Here are the main traps and how to solve them:

  • Problem: Flat Corporate Networks Kept for Convenience
    Ninja Solution: Implement VLANs and cloud security groups to segment traffic logically without replacing physical hardware.
  • Problem: Guest Wi-Fi Able to See Internal Server Addresses
    Ninja Solution: Configure client isolation and route guest Wi-Fi directly out to the internet via a separate virtual gateway.
  • Problem: Overly Permissive Firewall Rules (“Any-to-Any”) Left Active
    Ninja Solution: Audit firewall logs, identify legitimate traffic paths, and replace broad rules with explicit, port-specific permissions.
  • Problem: Outdated Network Diagrams That Do Not Match Reality
    Ninja Solution: Use automated network mapping tools to discover assets and generate live topology diagrams.

The ISO 27001 Ninja Bottom Line

ISO 27001 Annex A 8.22 is about limiting how far a security problem can travel. You cannot prevent every single phishing click or device compromise, but you can easily prevent a compromised laptop from destroying your core business platforms.

By dividing your network into logical domains, enforcing strict default-deny boundary rules, isolating wireless and vendor access, and keeping clear network diagrams, you contain security incidents, protect your critical assets, and prove complete compliance to your auditor.