ISO 27001:2022 Annex A 8.20 – Network Security Explained

Networks are where information moves — and where attackers look first.
If the network isn’t controlled, everything connected to it is exposed.

Annex A 8.20 exists to ensure organisations design, operate, and monitor networks securely, preventing unauthorised access, protecting data in transit, and limiting the impact of security incidents.

This control is about structural security, not just perimeter devices.

Quick Guide: Annex A 8.20 at a Glance

Annex A 8.20 of ISO 27001:2022 focuses on network security.

At a practical level, this means:

Protecting networks from unauthorised access and misuse
Controlling how data flows across networks
Segregating networks and network traffic where risk justifies it
Monitoring network activity for security-relevant events
Managing network components as critical security assets

The control does not mandate a specific architecture. It expects risk-based, well-managed network security controls aligned with business and operational needs.

In-Depth Guide to Annex A 8.20

What Is Annex A 8.20 and Why Does It Matter?

Networks connect:

Users
Systems and applications
Cloud services
Third-party suppliers

A weakness anywhere on the network can:

Enable unauthorised access
Allow lateral movement after compromise
Expose sensitive information
Undermine availability and resilience

Common network-related failures include:

Flat networks with no segmentation
Unmanaged or unknown devices
Weak or inconsistent filtering rules
Poor visibility of network activity

Annex A 8.20 ensures organisations treat the network as a security control in its own right, not just a transport layer.

This control replaces ISO 27001:2013 Annex A 13.1.1 and reflects modern hybrid, cloud, and interconnected environments.

How to Implement Annex A 8.20 Effectively

A pragmatic approach to Annex A 8.20 typically includes the following elements.

1. Define Network Security Responsibilities

Organisations should clearly define responsibility for:

Network design and architecture
Network configuration and maintenance
Security monitoring and response

Network security should be distinct from general system administration, even if roles overlap.

2. Document and Maintain Network Architecture

Organisations should maintain accurate, up-to-date documentation, including:

Network diagrams
Segmentation and trust boundaries
Key network devices and connections

Documentation supports:

Risk assessment
Incident response
Change management

Undocumented networks are unmanageable networks.

3. Segregate Networks Based on Risk

Annex A 8.20 strongly supports network segregation.

Segregation may include:

Separation of business-critical systems
Isolation of sensitive data environments
Separation of administrative traffic from user traffic
Segregation of development, test, and production environments

Segmentation limits the spread of incidents and reduces blast radius.

4. Control Network Access

Network access should be:

Restricted to authorised users, systems, and devices
Based on defined roles and responsibilities

Controls may include:

Authentication before network access
Device identification and validation
Restrictions on unauthorised or unmanaged devices

If you don’t know what is connected, you don’t control the network.

5. Protect Data in Transit

Annex A 8.20 expects organisations to protect information as it moves across networks.

This may include:

Encryption of network traffic
Secure communication protocols
Protection of data transmitted across third-party networks

Protection should reflect data sensitivity and exposure risk.

6. Filter and Control Network Traffic

Organisations should apply rules that:

Permit only required traffic
Block unnecessary or risky protocols
Restrict inbound and outbound connections

Traffic filtering should be:

Documented
Reviewed
Updated as systems and threats change

Default allow is rarely defensible.

7. Monitor Network Activity

Network security depends on visibility.

Organisations should:

Monitor network traffic and events
Detect abnormal or suspicious behaviour
Correlate network activity with logs and alerts

This aligns directly with:

Logging (Annex A 8.15)
Monitoring activities (Annex A 8.16)

Networks often show the first signs of compromise.

8. Manage Network Devices as Security Assets

Network equipment should be:

Inventoried and identifiable
Configured securely
Maintained and updated

This includes:

Routers
Firewalls
Switches
Wireless access points

Outdated or misconfigured devices create systemic risk.

9. Control Administrative Access to Network Components

Administrative access should be:

Restricted to authorised personnel
Logged and monitored
Separated from normal user access

Network administration is privileged activity and should be treated accordingly.

10. Address Third-Party and Interconnected Networks

Annex A 8.20 explicitly includes:

Connections to suppliers and partners
Cloud service connectivity
Shared or external networks

Organisations should ensure:

Security responsibilities are defined
Network access is limited to what is required
Interconnections are monitored and reviewed

External connectivity expands the attack surface.

11. Maintain the Ability to Isolate Networks During Incidents

During a security incident, organisations may need to:

Segregate affected sub-networks
Disable compromised connections
Temporarily suspend vulnerable protocols

Prepared isolation capability reduces impact and recovery time.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Practical Considerations

Annex A 8.20 does not require:

Enterprise-scale network complexity everywhere
Zero trust architectures by default
Constant re-architecture

It does require organisations to:

Understand their network
Control who and what can communicate
Monitor activity that matters

Most attackers succeed because networks are too permissive.

Common Challenges and How to Overcome Them

Flat networks with no segmentation
Introduce risk-based network separation

Unknown or unmanaged devices
Maintain visibility and control of network connections

Filtering rules never reviewed
Periodically review and rationalise traffic rules

No monitoring of network activity
Align network visibility with logging and monitoring controls

Network weaknesses are architectural, not accidental.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Final Recommendations

Annex A 8.20 is about controlling how systems talk to each other.

When network security is implemented effectively:

Unauthorised access is harder
Incidents spread less
Detection is faster
Recovery is more controlled

Applications protect data.
Users handle information.
Networks connect everything.

Annex A 8.20 ensures those connections are deliberate, controlled, and defensible.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

ISO 27001:2022 Annex A 8.20 – Network Security Explained

Quick Guide: Annex A 8.20 at a Glance

In-Depth Guide to Annex A 8.20

What Is Annex A 8.20 and Why Does It Matter?

How to Implement Annex A 8.20 Effectively

1. Define Network Security Responsibilities

2. Document and Maintain Network Architecture

3. Segregate Networks Based on Risk

4. Control Network Access

5. Protect Data in Transit

6. Filter and Control Network Traffic

7. Monitor Network Activity

8. Manage Network Devices as Security Assets

9. Control Administrative Access to Network Components

10. Address Third-Party and Interconnected Networks

11. Maintain the Ability to Isolate Networks During Incidents

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Practical Considerations

Common Challenges and How to Overcome Them

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Final Recommendations

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

The Annex Control Table

ISO 27001:2022 Organisational Controls

ISO 27001:2022 People Controls

ISO 27001:2022 Physical Controls

ISO 27001:2022 Technological Controls

Solutions

Quick Links

Follow Us On:

Solutions

Quick Links

Follow Us On:

Unsure where to start, lets talk!