All 93 controls · Technological controls
Control 8.21
Security of network services
What ISO/IEC 27002:2022 control 8.21 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
For each network service, the organization is to identify, put in place and monitor the security mechanisms, the service levels and the requirements that apply. Purpose: make using network services safe. Guidance: identify and implement the security measures a given service needs, including security features, service levels and requirements, whether it is provided internally or externally, and make sure providers implement them. Determine and regularly monitor each provider's ability to manage the agreed services securely, agree a right to audit, and consider third-party attestations from providers showing they maintain appropriate security. Rules for using networks and network services should cover which networks and services may be accessed; authentication requirements for each service; authorization procedures deciding who may reach which networks and services; management, technical controls and procedures protecting access to network connections and services; the means of access, such as VPN or wireless; the user's time, location and other attributes at access; and monitoring of service use. Security features to consider include the technologies securing the service, such as authentication, encryption and connection controls; the technical parameters needed for a secure connection under the security and connection rules; caching, for example in content delivery networks, with parameters that let users choose caching according to performance, availability and confidentiality needs; and usage procedures that limit who may reach particular services or applications when needed. Network services range from simple unmanaged bandwidth to connections, private network services and managed security services such as firewalls and intrusion detection; ISO/IEC 29146 gives an access management framework.
Purpose in the standard’s terms, in our words: Keeps the use of network services secure.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; System and network security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | System and network security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Service agreements with internal and external network providers specifying security features, service levels and requirements
- Right-to-audit clauses and third-party attestations from network and managed security service providers, with records of review
- Monitoring reports on provider performance against agreed security and service levels
- Documented rules on permitted networks and services, authentication, authorization, means of access (VPN, wireless) and contextual conditions
- Technical parameters for secure connections, such as encryption and connection control settings, and caching decisions for CDN services
Where audits commonly find gaps
- Network service contracts specify bandwidth and uptime but no security requirements
- Managed security providers are never audited and attestation reports are not reviewed
- No rules define which networks users may connect to or how
- CDN caching settings expose confidential content
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (13.1.2) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.