How to Audit ISO 27001 Annex A 8.20: Network Security

In this ultimate how to audit guide to ISO 27001 Annex A 8.20 Network Security, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 8.20 Network Security Audit Checklist

Auditing ISO 27001 Annex A 8.20 Network Security is the technical verification of infrastructure hardening and traffic segregation protocols. The Primary Implementation Requirement is the logical separation of network zones and encryption of data in transit, providing the Business Benefit of preventing lateral movement and ensuring secure communications integrity.

This technical verification tool is designed for lead auditors to establish the security posture of network infrastructure and data in transit. Use this checklist to validate compliance with ISO 27001 Annex A 8.20.

1. Network Security Policy Formalisation Verified

Verification Criteria: A documented policy exists defining the security requirements for network management, including baseline configurations and restricted protocols.

Required Evidence: Approved Network Security Policy or Infrastructure Hardening Standard with explicit version control.

Pass/Fail Test: If the organisation cannot produce a formal policy specifying the mandatory security controls for network equipment, mark as Non-Compliant.

2. Network Segmentation and Segregation Confirmed

Verification Criteria: Technical controls (VLANs, Subnets, or Micro-segmentation) separate the network into logical zones based on sensitivity and function (e.g., DMZ, Corporate, Guest).

Required Evidence: Current network topology diagram and firewall configuration logs showing active traffic isolation between zones.

Pass/Fail Test: If the Guest Wi-Fi or a low-security zone has direct, unfirewalled routing to the production database environment, mark as Non-Compliant.

3. Restricted Use of Insecure Protocols Validated

Verification Criteria: Legacy or insecure protocols (e.g., Telnet, FTP, HTTP, SMBv1) are disabled across all network devices in favour of secure alternatives (SSH, SFTP, HTTPS).

Required Evidence: Port scan results (Nmap) or device configuration exports showing specific port closures.

Pass/Fail Test: If any network management interface is accessible via unencrypted Telnet or HTTP, mark as Non-Compliant.