Networks are where information moves, and where attackers look first. If your network is not controlled, every single device connected to it is completely exposed. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat their network as a background transport layer, focusing only on individual servers or software. A weak network turns a minor endpoint infection into a business-wide breach.
ISO 27001:2022 includes Annex A 8.20 to make sure you treat structural network security as a primary control capability. This control ensures your business designs, operates, and monitors internal, hybrid, and cloud networks securely, keeping attackers out while controlling data in transit.
Quick Summary: What ISO 27001 Annex A 8.20 Requires
At a practical level, Annex A 8.20 is about structural network control, visibility, and containment. It updates former standards to cover modern hybrid, remote, and cloud infrastructure. Here is what you need to do in plain English:
- Define Network Roles & Responsibilities: Assign clear ownership for network design, configuration, and security monitoring.
- Document Network Architecture: Maintain clear, up-to-date diagrams showing trust boundaries, firewalls, and subnets.
- Enforce Network Access Controls: Restrict network connectivity to authenticated, authorised, and managed devices.
- Filter Inbound and Outbound Traffic: Apply “deny by default” firewall rules to block unapproved protocols and IP addresses.
- Encrypt Data in Transit: Protect internal and external network traffic using secure communication protocols (Annex A 8.24).
- Build Rapid Network Isolation Capabilities: Ensure technical leads can isolate infected subnets or cut vendor connections fast during an incident.
Why Unmanaged Network Security Is a Major Risk
Your network connects users, cloud applications, databases, and third-party vendors. If you do not manage structural network security, bad actors use the network as an open highway to move laterally and compromise your core assets.
Ignoring network security creates severe business hazards:
- Unrestricted Lateral Movement: Hackers compromising a single low-risk endpoint and pivoting freely into live production servers.
- Interception of Sensitive Traffic: Plain-text credentials, financial details, or client data being intercepted as it moves across networks.
- Rogue Unmanaged Devices: Unvetted personal laptops or unsecured smart office hardware connecting to corporate assets undetected.
- Cascading Supply Chain Attacks: A breach inside a third-party vendor’s network spreading directly into your environment over shared connections.
My 11 Step Plan to Implement Annex A 8.20 Fast
You do not need to build an overly complex enterprise architecture to satisfy an ISO 27001 auditor. Here is my pragmatic, 11-step plan to establish audit-ready network security across your business.
1. Assign Explicit Network Security Ownership
Network security controls degrade fast when responsibility is vague. Clearly separate network security management from basic IT desktop support:
- Designate specific personnel responsible for network architecture, firewall rule changes, and boundary controls.
- Assign dedicated responsibility for monitoring network activity and security alerts (Annex A 8.16).
- Ensure network administration credentials are strictly controlled and audited.
2. Document and Maintain Network Diagrams
If you do not know how your network is built, you cannot defend it. Maintain accurate, up-to-date technical records:
- Create visual network topology diagrams mapping out physical, virtual, and cloud subnets.
- Identify all entry points, internet gateways, boundary firewalls, and third-party connections.
- Document security trust zones and boundary controls inside your configuration management register (Annex A 8.9).
3. Segregate Networks Based on Risk
Flat networks are an attacker’s dream. Divide your network into distinct security domains to contain potential incidents (Annex A 8.22):
- Isolate core server databases from general employee desktop networks.
- Separate administrative traffic completely from standard user data flows.
- Keep development, staging, and production environments logically isolated (Annex A 8.31).
4. Enforce Strict Network Access Rules
Block unknown devices from connecting to your corporate network assets by default:
- Implement Network Access Control (NAC) or 802.1X authentication for physical and wireless connections.
- Require explicit device registration and compliance checks before granting network access.
- Disable unused physical network wall ports in office spaces to prevent unauthorized drop-in connections.
5. Encrypt Sensitive Data Moving Across Networks
Protect data in transit across internal networks, cloud links, and external internet connections:
- Enforce modern cryptographic protocols (like TLS 1.2+ or SSH) for all web interfaces and API feeds (Annex A 8.24).
- Mandate secure, encrypted VPNs or Zero Trust Network Access (ZTNA) for remote workers connecting over public networks.
- Disable unencrypted, legacy protocols (like Telnet, HTTP, or FTP) across your entire network.
6. Filter Traffic with “Deny by Default” Rules
Do not allow unrestricted network traffic. Configure firewalls and cloud security groups to block everything unless explicitly permitted:
- Document the business justification for every open inbound and outbound network port.
- Restrict outbound connections to stop compromised devices from communicating with external command-and-control servers.
- Audit firewall rule sets bi-annually to prune obsolete or redundant access rules.
7. Monitor Network Activity for Anomalies
Network traffic provides the earliest warning signs of an active breach or policy violation:
- Deploy network intrusion detection or automated threat monitoring across critical boundaries.
- Set up real-time alerts for abnormal data transfers, after-hours traffic spikes, or unauthorized port scans.
- Correlate network event feeds directly with your central SIEM or log management tools (Annex A 8.15).
8. Harden Network Devices as Critical Assets
Routers, switches, firewalls, and wireless access points are primary targets for hackers. Treat them as high-value security assets:
- Change all default administrative passwords and default SNMP strings immediately upon installation.
- Apply firmware updates and security patches promptly to eliminate hardware vulnerabilities.
- Back up network appliance configurations regularly to support fast disaster recovery.
9. Lock Down Administrative Access to Hardware
Managing network infrastructure is a high-privilege task. Restrict administrative entry points tightly:
- Enforce Multi-Factor Authentication (MFA) for all administrative logins to firewalls and switches (Annex A 8.5).
- Restrict network management interfaces so they are accessible only from dedicated, isolated management subnets or jump hosts.
- Log every administrative configuration change and session command for audit traceability.
10. Secure Interconnected and Third-Party Networks
Connections provided to external partners, suppliers, or cloud platforms expand your overall attack surface:
- Terminate third-party network connections inside isolated DMZ zones rather than core internal subnets.
- Limit partner access strictly to the single system or IP needed for their service.
- Review vendor connection logs regularly and terminate access immediately when contracts end.
11. Build Rapid Network Isolation Capabilities
When an incident occurs, speed matters. Ensure your technical team can contain a compromise instantly without crashing the entire business:
- Pre-script automated network isolation commands inside your Endpoint Detection and Response (EDR) tools.
- Document step-by-step procedures to sever compromised third-party VPN links or isolate subnets quickly.
- Test network isolation procedures periodically during business continuity drills.
Common Implementation Pitfalls and How to Fix Them
When preparing clients for ISO 27001 audits, I frequently spot the same network security mistakes. Here are the main traps and how to solve them:
- Problem: Flat Corporate Networks Kept for Convenience
Ninja Solution: Use VLANs, subnets, and cloud security groups to segment traffic logically without replacing physical hardware. - Problem: Firewall Rules Accumulating Over Time Without Review
Ninja Solution: Put a recurring reminder on your calendar to review, clean up, and document firewall rules twice a year. - Problem: Unmonitored Devices Connected to the Corporate Wi-Fi
Ninja Solution: Implement 802.1X device authentication for corporate Wi-Fi and push visitors to an isolated guest network. - Problem: Outdated Network Diagrams That Do Not Match Reality
Ninja Solution: Use automated discovery tools to map active network assets and keep visual topology diagrams current.
The ISO 27001 Ninja Bottom Line
ISO 27001 Annex A 8.20 is about treating your network as a core security control rather than a basic transport layer. You cannot prevent every single phishing email or device infection, but you can easily prevent a compromised endpoint from taking down your whole business.
By establishing clear ownership, maintaining updated diagrams, enforcing strict firewall filtering, encrypting data in transit, and keeping rapid isolation procedures ready, you build a defensible, resilient network that protects your business and satisfies your ISO 27001 auditor.