All 93 controls · Technological controls
Control 8.20
Networks security
What ISO/IEC 27002:2022 control 8.20 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Networks and network devices are to be secured, managed and controlled so that information in systems and applications is protected. Purpose: protect information in networks and the facilities that support it from being compromised through the network. Guidance: implement controls that secure information in networks and protect connected services from unauthorized access, considering: the kinds and classification of information the network can carry; responsibilities and procedures for managing network equipment and devices; current documentation including network diagrams and device configuration files for routers, switches and similar; where suitable, keeping network operations under different responsibility from running ICT systems (5.3); controls protecting the confidentiality and integrity of data over public, third-party or wireless networks and protecting connected systems and applications (5.22, 8.24, 5.14, 6.6), plus measures for availability of network services and connected computers; logging and monitoring that records and detects security-relevant actions (8.15, 8.16); close coordination of network management so service is optimized and controls are applied consistently across the infrastructure; authenticating systems on the network; restricting and filtering system connections, for example with firewalls; detecting, restricting and authenticating equipment and devices connecting to the network; hardening network devices; separating network administration channels from other traffic; being able to isolate critical subnetworks temporarily if the network is attacked; and disabling vulnerable network protocols. Apply suitable security to virtualized networks, including software-defined networking and SD-WAN, which can help by logically separating communications over shared physical networks, especially for distributed systems. Other information: see the ISO/IEC 27033 series and ISO/IEC TS 23167.
Purpose in the standard’s terms, in our words: Protects information in networks and supporting facilities from compromise via the network.
Attribute values in one line: Preventive, Detective; Confidentiality, Integrity, Availability; Protect, Detect; System and network security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | PreventiveDetective |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | ProtectDetect |
| Operational capabilities | System and network security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Current network diagrams and device configuration backups for routers, switches, firewalls and wireless controllers
- Defined responsibilities and procedures for network device management, separated from system operations where appropriate
- Firewall rule sets, network access control configuration and device authentication (for example 802.1X) restricting what can connect
- Hardening standards for network devices and evidence that insecure protocols are disabled
- A segregated management network or out-of-band administration channel
- Network logs and monitoring coverage, and encryption of data crossing public, third-party or wireless networks
Where audits commonly find gaps
- Network diagrams are years out of date
- Management interfaces of network devices are reachable from user networks
- Unknown devices can connect to wired ports without any authentication
- Legacy protocols such as Telnet or SNMPv1 remain enabled
What ISO/IEC 27028 changes for this control
It carries more than one control type (preventive, detective), so the register should record each and the evidence that proves each one operates. Its earlier numbering (13.1.1) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.