Key takeaways
- Separate groups of systems, users and services on networks.
- Segmenting networks contains breaches and limits access to sensitive systems.
- Start here: group systems by trust level and function.
Purpose
Separate groups of systems, users and services on networks.
Requirement
Requirement summaryGroups of information services, users and information systems shall be segregated in the organization’s networks.
Why it matters
Segmenting networks contains breaches and limits access to sensitive systems.
How to implement
- Group systems by trust level and function.
- Separate them using VLANs, subnets or cloud security groups.
- Control traffic between segments.
- Isolate guest and IoT networks.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.22. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for separating networks (for example guests, staff, servers, test and live).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.22 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A network diagram showing separate segments.
- Rules controlling traffic between segments.
- Records of reviews of those rules.
- Approvals for any exceptions.
Things you should be able to show or explain
- Be able to show that the guest network can't reach internal systems.
How much to show: Two or three segments.
Common mistakes
- Everything on one flat network.
- Guests can reach internal systems.
- Flat networks where every device can reach everything.
- Guest Wi-Fi connected to internal systems.
- Tip: Put guest Wi-Fi on its own network.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.22 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.22?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for separating networks (for example guests, staff, servers, test and live)…