Key takeaways
- Secure and manage networks to protect information.
- Networks connect everything.
- Start here: document your network architecture.
Purpose
Secure and manage networks to protect information.
Requirement
Requirement summaryNetworks and network devices shall be secured, managed and controlled to protect information in systems and applications.
Why it matters
Networks connect everything. Securing them limits how far attackers can travel.
How to implement
- Document your network architecture.
- Protect devices with secure configurations and firewalls.
- Restrict management interfaces.
- Monitor network traffic.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.20. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your network security requirements.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.20 marked as used or not used, a short reason, and its current status.
Records and examples to show
- An up-to-date network diagram.
- Records of firewall rule reviews.
- Configuration records for network devices.
- Records of network security changes and their approval.
Things you should be able to show or explain
- Be able to explain how your network is protected from outside threats.
How much to show: The last firewall rule review.
Common mistakes
- Diagram out of date.
- Firewall rules that allow too much.
- Out-of-date network diagrams.
- Management ports open to the internet.
- Tip: Document your network diagram and firewall rules.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.20 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.20?
Be ready to explain how the control works in your organisation and to provide things like: Your network security requirements…