Almost every breach crosses a network at some point. ISO 27001 communications security protects information as it moves: across your internal network, over the internet, by email and file sharing, and to partners. It also limits how far an attacker can move once inside.
In the 2013 edition, this was Annex A.13, with seven controls. In 2022, they became five controls, and a new control for web filtering joined them. This guide explains each and how to implement it.
Free tool: How ready is your organization? Take our ISO 27001 self-assessment: 30 questions on clauses 4–10 and Annex A.
Mapping: A.13 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.13.1.1 Network controls | 8.20 Networks security |
| A.13.1.2 Security of network services | 8.21 Security of network services |
| A.13.1.3 Segregation in networks | 8.22 Segregation of networks |
| A.13.2.1 to A.13.2.3 Information transfer and electronic messaging | 5.14 Information transfer |
| A.13.2.4 Confidentiality or non-disclosure agreements | 6.6 Confidentiality or non-disclosure agreements |
| New in 2022 | 8.23 Web filtering |
8.20 Networks security
First, secure and manage your networks and the devices on them. Key measures include:
- an up-to-date network diagram and device inventory;
- hardened configurations for routers, switches, firewalls and Wi-Fi;
- secure management access, for example SSH with MFA via TACACS+ or RADIUS;
- logging and monitoring of network devices;
- encryption for remote and wireless access.
For a refresher on device authentication, read our guide to AAA in networking.
8.21 Security of network services
Next, define security requirements for network services, whether in-house or from providers. This includes internet links, SD-WAN, DNS, VPN and cloud networking. For example, agree on availability levels, DDoS protection and incident notification in contracts. Then monitor providers against those terms.
8.22 Segregation of networks
Then split your network into zones based on trust and function. For instance:
- separate guest Wi-Fi from the corporate network;
- isolate servers, payment systems and operational technology;
- put internet-facing systems in a DMZ;
- restrict traffic between zones with firewalls or ACLs.
As a result, one infected laptop cannot reach every server. Our ACL questions and answers show how to write such rules on Cisco devices.
8.23 Web filtering (new)
This new control asks you to manage access to external websites. It reduces exposure to malware, phishing and illegal content. Typical measures include DNS filtering, secure web gateways and blocking known malicious domains. However, avoid blocking so much that people bypass the controls.
5.14 Information transfer
Information leaves your organization every day by email, file sharing, messaging apps, USB drives and even phone calls. Therefore, set rules for each method:
- which channels are approved for each classification level;
- encryption for confidential data in transit, such as TLS and encrypted file sharing;
- email security, for example SPF, DKIM, DMARC and malware scanning;
- agreements with partners before you exchange sensitive data;
- care with verbal communication in public places.
6.6 Confidentiality or non-disclosure agreements
Finally, protect information shared with staff, contractors and partners through NDAs. Review templates regularly, and make sure they reflect your classification and legal needs.
Common mistakes
- Flat networks: everything sits on one VLAN, so ransomware spreads freely.
- Forgotten rules: old firewall rules stay open years after a project ends.
- Shadow channels: staff share files through personal messaging or cloud accounts because approved tools are hard to use.
- Unmanaged providers: nobody checks whether the ISP or SD-WAN vendor meets its security commitments.
Fixing these gives you quick wins before an audit, and it also cuts real risk.
What auditors check
- Network diagrams that match reality.
- Firewall rule reviews, with removal of unused rules.
- Evidence of segregation, such as VLAN and firewall configurations.
- An information transfer policy and email security settings.
- Signed NDAs for a sample of staff and suppliers.
FAQ
Is a VPN required by ISO 27001?
No specific technology is required. However, you must protect remote access, and a VPN or zero-trust access service is the usual answer.
Does DMARC count towards ISO 27001?
Yes. It supports control 5.14 by protecting email from spoofing.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
