Networks are only as secure as the services running on them. If your network services are weak, protected systems quickly become irrelevant. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses spend heavily on perimeter firewalls, only to leave directory services, email routing, or remote access protocols wide open and unmonitored. Hackers rarely attack the cable or the router, they exploit the services running across them.
ISO 27001:2022 includes Annex A 8.21 to ensure you secure what the network actually delivers. This control focuses on managing internal, external, and third-party network services, preventing unauthorized entry, service disruption, and data interception.
Quick Summary: What ISO 27001 Annex A 8.21 Requires
At a practical level, Annex A 8.21 is about service-level security, ownership, and control. It moves beyond basic connectivity to ensure every network service operates safely. Here is what you need to do in plain English:
- Inventory All Network Services: Maintain a clear record of every internal, cloud, and third-party network service in use.
- Set Explicit Access Rules: Define who can access specific services, from which locations, and at what times.
- Enforce Strong Authentication: Require multi-factor authentication (MFA) and strong credentials for all service entry points.
- Encrypt Data in Transit: Protect service communications using modern cryptographic protocols (TLS/SSL).
- Monitor and Log Service Usage: Track successful logins, failed attempts, and administrative changes across all services.
- Govern Third-Party Service Providers: Embed clear security obligations and service level agreements (SLAs) into supplier contracts.
Why Insecure Network Services Are a Major Risk
A network service is any functionality delivered over a network—including directory services (Active Directory/LDAP), email platforms, DNS, remote desktop protocols (RDP), VPNs, and API gateways. Leaving these services unmanaged creates direct pathways into your core infrastructure.
Failing to secure network services exposes your business to severe hazards:
- Unauthorized System Entry: Attackers exploiting weak authentication on exposed remote management or VPN services.
- Data Interception and Spoofing: Intercepting plain-text service traffic or exploiting unencrypted communication channels.
- Service Disruption and Outages: Unmonitored network services getting overwhelmed, misconfigured, or abused by bad actors.
- Third-Party Vendor Breaches: Managed service providers (MSPs) suffering compromises that cascade directly into your network.
My 11 Step Plan to Implement Annex A 8.21 Fast
You do not need an unmanageable management setup to satisfy an ISO 27001 auditor. Here is my pragmatic, 11-step plan to establish audit-ready network service security across your business.
1. Identify All In-Scope Network Services
You cannot secure services you do not know exist. Build a comprehensive inventory covering all network services across your organisation:
- Internal core services (DNS, DHCP, Active Directory, file/print shares).
- Public and internet-facing services (web portals, API gateways, external mail relays).
- Remote connectivity services (VPNs, zero-trust network access, remote desktop gateways).
- Cloud and third-party managed network tools (SaaS applications, cloud firewalls, managed DNS).
2. Define Security Requirements Per Service
Do not apply a single blanket rule across every tool. Tailor security requirements based on the risk and exposure of each network service:
- Specify required authentication strength, encryption standards, and idle timeouts.
- Establish availability, redundancy, and disaster recovery baselines.
- Align service security rules with your information classification scheme (Annex A 5.12).
3. Restrict and Control Service Access
Open access to network services is rarely justified. Enforce explicit boundaries on who can interact with each service:
- Restrict service access based on verified business need and job role (least privilege).
- Limit connection attempts to approved IP ranges, corporate subnets, or specific geographic locations.
- Disable or block unused network services, legacy protocols, and unneeded open ports.
4. Enforce Strong Authentication and Authorisation
Never allow network services to rely on simple passwords or implicit network trust. Lock down service access points:
- Mandate Multi-Factor Authentication (MFA) for all external, remote, and privileged service connections (Annex A 8.5).
- Use centralized identity providers (Single Sign-On / SAML / OAuth) rather than isolated local accounts.
- Enforce strict role-based authorisation to control what users can do once connected to a service.
5. Encrypt Service Communications in Transit
Protect all network service traffic from eavesdropping and tampering by using modern cryptographic protocols:
- Enforce strong encryption (TLS 1.2+ or SSH) for all data moving across internal and external network services (Annex A 8.24).
- Disable outdated, insecure protocols like HTTP, Telnet, FTP, or early SSL/TLS versions.
- Implement secure certificate management to ensure service SSL/TLS certificates stay updated.
6. Filter and Shield Service Traffic
Protect network services from direct internet exposure using front-line technical safeguards:
- Place sensitive network services behind web application firewalls (WAFs) or reverse proxies.
- Use network access control lists (ACLs) to filter unauthorized connection requests (Annex A 8.22).
- Deploy rate-limiting and anti-DDoS protections on public-facing service endpoints.
7. Monitor Network Service Usage Continuously
Unmonitored network services are dangerous operational blind spots. Keep active visibility over service health and behavior:
- Track real-time service access, connection volumes, and performance metrics.
- Establish baseline usage patterns so security teams can spot abnormal spikes or access anomalies.
- Set up automated alerts for unusual after-hours connections or brute-force login attempts.
8. Enable Comprehensive Service Logging
Ensure every network service generates detailed, tamper-evident activity logs to support audits and investigations:
- Log all successful logins, failed access attempts, administrative changes, and policy breaches (Annex A 8.15).
- Forward service logs to a central, secure log management or SIEM platform.
- Review service logs regularly to confirm accountability and detect potential policy drift.
9. Secure Third-Party and Managed Network Services
Outsourcing a network service to an MSP or cloud vendor does not outsource your ultimate compliance risk:
- Embed explicit security standards and data protection rules into vendor contracts.
- Define clear division of responsibilities between your internal team and the service provider.
- Review vendor SOC 2 reports, ISO 27001 certificates, or independent audit reports annually.
10. Establish and Monitor Service Levels (SLAs)
Ensure network services maintain the availability and resilience required by your business operations:
- Define explicit uptime, latency, and recovery time objectives (RTO) for critical services.
- Monitor provider performance against contractual SLAs continuously.
- Incorporate network service failover checks into your business continuity testing routines.
11. Manage Service Changes Systematically
Uncontrolled modifications to network service configurations are a primary cause of accidental outages and security holes:
- Route all service configuration tweaks and upgrades through your formal change management process (Annex A 8.32).
- Test service changes inside a staging environment before applying them to live production setups.
- Maintain full rollback procedures and update technical documentation after every change.
Common Implementation Pitfalls and How to Fix Them
When preparing clients for ISO 27001 audits, I frequently spot the same network service mistakes. Here are the main traps and how to solve them:
- Problem: Assuming Network Firewalls Automatically Secure Services
Ninja Solution: Enforce service-level controls including MFA, encryption, role-based access, and active monitoring. - Problem: Unmonitored Third-Party MSP Connections
Ninja Solution: Require vendor multi-factor authentication, restrict access to specific management jump hosts, and log sessions. - Problem: Default Admin Credentials Left on Network Appliances
Ninja Solution: Audit all network services, change default passwords immediately, and enforce central SSO logins. - Problem: Legacy Plain-Text Protocols Active on Internal Networks
Ninja Solution: Disable Telnet, HTTP, and early TLS versions, replacing them with SSH, HTTPS, and modern encryption standards.
The ISO 27001 Ninja Bottom Line
ISO 27001 Annex A 8.21 is about securing what actually delivers functionality to your users, clients, and internal systems. Networks connect your devices, but services are what make them usable—and vulnerable.
By keeping a full inventory of your services, locking down entry points with strong authentication, encrypting traffic in transit, logging activity, and holding third-party providers accountable, you keep your business operational, resilient, and completely ready for audit success.