ISO 27001 Annex A 8.22 Segregation of Networks Explained

ISO 27001 Segregation of Networks

ISO 27001 Annex A 8.22 Segregation of networks is an ISO 27001 control that requires us group information services and then put those groups on different networks.

Ideally it wants information services, users and information systems on different networks but it is a little more nuanced than that so let’s take a look.

Key Takeaways

ISO 27001 Annex A 8.22 mandates that your network should not be one giant “flat” space where every device can talk to every other device. Instead, you must slice your network into smaller, isolated zones (segments) based on trust levels. This ensures that if one zone is compromised (e.g., Guest Wi-Fi), the attacker is trapped there and cannot reach your critical servers.

Purpose

ISO 27001 Annex A 8.22 is a preventive control to split the network in security boundaries and to control traffic between them based on business needs.

Definition

The ISO 27001 standard defines ISO 27001 Annex A 8.22 as:

Groups of information services, users and information systems should be segregated in the organisation’s networks.

ISO27001:2022 Annex A 8.22 Segregation of Networks

Explanation

ISO 27001 Annex A 8.22 is a security control that mandates the segregation of networks to restrict data flow between different trust zones. It requires organizations to implement logical or physical network boundaries, ensuring that a compromise in one segment (e.g., Guest Wi-Fi) cannot laterally spread to critical systems, thereby limiting the blast radius of cyberattacks.

Requirement

• Limit the Blast Radius: The primary goal is containment. If a receptionist’s PC gets a virus, network segregation ensures the virus cannot automatically spread to the Finance Server.
• The “Guest” Rule: This is the most common example. Guest Wi-Fi must be completely isolated from the Corporate Wi-Fi. Guests should only be able to see the Internet, not your internal printers or file shares.
• Logical Separation (VLANs): You don’t need separate physical wires for every network. You can use VLANs (Virtual Local Area Networks) to logically chop up a single switch into multiple secure zones.
• Access Control Lists (ACLs): Segregation isn’t just about splitting networks; it’s about controlling the traffic between them. You need firewall rules that say “Zone A can talk to Zone B, but ONLY on port 443.”

Audit Focus

1. The Boundaries: “Show me where the Guest Network ends and the Corporate Network begins.”
2. The Gateways: “Show me the firewall that sits between these two zones.”
3. The Evidence: They might ask you to try and “Ping” a critical server from a guest device. If it replies, you fail.

Guidance

This control is really looking at large and complex networks. On the most part for small organisations you are going to have your main office network, possibly a public network, potentially a wifi network that ideally will be treated as public and operational networks will be handled by cloud service providers who you no doubt use. Still, let’s look at little more at the guidance.

At no point would this guide look to tell you how to implement a network and at all times I would say that you clearly need the services of a trained, experienced, network professional whose advice you should follow. As long as they adhere to the principles, you will be fine.

The difference between network segmentation and network segregation

Segmentation is the structural division of a network, while segregation is the enforcement of access controls between those divisions.

• Network Segmentation: The act of slicing a larger network into smaller subnetworks (e.g., creating VLANs for HR, Sales, and Guests). It is the “architecture.”
• Network Segregation: The application of security rules that isolate these segments from one another (e.g., firewall rules that block the Guest VLAN from accessing the HR VLAN). It is the “policy.”

Choosing Network Domains

Breaking a network into domains is not something to do lightly. Every time you introduce a new domain you introduce a management overhead which you counter balance against the risk. Consider for the network domains things like trust levels, use, criticality, geography. There are many ways to crack an egg.

Take your time and think about this logically.

Network Types

The standard clearly is not only talking about physical wired networks but also virtual networks.

Network Perimeter

The area to focus on is the network boundary, this is the perimeter of the network. This is the part that protects the access into the main network. Like the door to a house. It should be secured. Where doors have keys you will consider firewalls, filtering, routing.

Who can gain access through the perimeter will take into consideration Access Control and the topic specific policy on Access Control.

To implement this you want a well defined boundary with well defined and implemented controls in place.

Wireless Networks

Where ever possible I would recommend that wireless networks are only ever used for public services, non critical data and traffic. It may be the case that you have to use them but they do come with a lot of disadvantages and challenges. You can potentially overcome them with compensating controls such as VPN, encrypted traffic and such like but they really want separating from the main networks. Take care when implementing wireless networks but do keep them segregated.

Network Security Policy Template

The network security policy sets out your approach to network segregation.

Access to networks and services

For this we consider what can and should be accessed and then have appropriate policy and process in place around that access. 

ISO 27001 Annex A 5.15 Access Control

ISO 27001 Annex A 5.18 Access Rights

Authentication

The requirements on authentication for accessing services should be set. 

ISO 27001 Annex A 5.17 Authentication Information

Authorisation

Procedures that determine who is allowed to access networks and services are to be put in place. 

ISO 27001 Annex A 5.15 Access Control

Technical Controls

The network management and technical controls as well as the processes to access connections and services will be in place. 

ISO27001 Annex A 8.20 Network Security

Access Types

How access is carried out such as physical network, wireless network, VPN will be determined.

Monitoring and Logging

Recording the time, location and other appropriate logging attributes of users that access networks and services will be in place.

ISO 27001 Annex A 8.16 Monitoring Activities

Security Features

The security features of networks will be identified and implemented as well as documented. Consider here things like encryption, connection controls, cacheing, restrictive access. Firewalls, private networks, intrusion detection are also to be considered.

Network Security Professional

All in all you should work what a network security professional to work out the best solution for you and your needs. Your requirement is to identify, document, implement, monitor and review it.

FREE Training Video

In this free training video you will learn How to implement ISO 27001 Segregation of Networks (Annex A 8.22) and Pass Your Audit.

How to implement it

Implementing network segregation is a fundamental security control designed to contain potential breaches and limit lateral movement within an infrastructure. By following these technical implementation steps, your organisation can satisfy ISO 27001 Annex A 8.22 requirements and ensure that sensitive data remains isolated from less secure network zones.

1. Categorise Network Services and Asset Groups

• Identify and group information assets based on their sensitivity, criticality, and functional requirements, such as separating guest Wi-Fi from internal corporate traffic.
• Define the “Rules of Engagement” (ROE) for traffic flow between these groups, documenting which services are permitted to communicate across boundaries.
• Result: A structured network map that serves as the blueprint for all logical and physical segregation efforts.

2. Provision Logical Segregation via VLANs and VRFs

• Configure Virtual Local Area Networks (VLANs) to create distinct broadcast domains, preventing unauthorised devices from sniffing internal traffic.
• Utilise Virtual Routing and Forwarding (VRF) instances for high-security environments to maintain separate routing tables on the same physical hardware.
• Result: Logical isolation that ensures data packets remain within their designated security zones unless explicitly routed elsewhere.

3. Formalise Gateway Controls and Access Control Lists (ACLs)

• Deploy stateful firewalls at the perimeter of each network segment to inspect all incoming and outgoing traffic for malicious patterns.
• Implement granular Access Control Lists (ACLs) on switches and routers to enforce the Principle of Least Privilege at the network layer.
• Result: Technical enforcement of segregation policies that drops non-compliant or unauthorised connection attempts automatically.

4. Establish De-militarised Zones (DMZs) for Public Services

• Provision a DMZ to host all public-facing services, such as web servers and email gateways, acting as a buffer between the internet and the internal network.
• Ensure that no direct connections are allowed from the DMZ to the internal “Trusted” zone without passing through an application-layer proxy or deep-packet inspection.
• Result: Protection of core business databases and internal systems from direct exposure to internet-borne threats.

5. Revoke Flat Network Access with Zero Trust Micro-segmentation

• Transition from a flat network architecture to micro-segmentation, where security policies are applied to individual workloads or virtual machines.
• Integrate Identity and Access Management (IAM) roles with network access policies, requiring Multi-Factor Authentication (MFA) for administrative access to restricted segments.
• Result: A significantly reduced blast radius during a security incident, as attackers cannot move laterally between compromised hosts.

6. Implement Centralised Logging and Continuous Monitoring

• Configure all network boundaries to export logs to a centralised Security Information and Event Management (SIEM) system.
• Establish automated alerts for “Cross-Zone Violation” events, where traffic attempts to bypass defined segregation boundaries.
• Result: Real-time visibility into the health and integrity of the segregated network, facilitating rapid incident response.

What will an auditor check?

The audit is going to check a number of areas. Lets go through the main ones:

1. That you have documentation: What this means is that you need to show that you have documented your network architecture and segregation rules.
2. Network Diagram: They will ask to see a high-level network diagram showing the different zones (Corporate, Guest, DMZ) and the gateways between them.
3. Evidence of Controls: They will check firewall rules to ensure that traffic is actually restricted as per your policy (e.g., Guest VLAN cannot access HR VLAN).

Network Security Policy Example

An example of the ISO 27001 Network Security Policy.

ISO 27001 Templates

Related ISO 27001 Controls

• ISO 27001 Annex A 8.20 Network Security
• ISO 27001 Annex A 8.16 Monitoring Activities
• ISO 27001 Annex A 5.15 Access Control

About the author