ISO 27001:2022 Annex A 8.22 – Segregation of Networks Explained

Once an attacker gets a foothold, they don’t stop at one system.
They move sideways — unless the network stops them.

Annex A 8.22 exists to ensure organisations segregate networks appropriately, restricting traffic between network domains to reduce the spread of incidents and protect sensitive information.

This control is about containing impact, not just keeping attackers out.

Quick Guide: Annex A 8.22 at a Glance

Annex A 8.22 of ISO 27001:2022 focuses on network segregation.

At a practical level, this means:

Dividing networks into logical or physical sub-networks
Restricting traffic between those sub-networks
Applying access controls at network boundaries
Segregating networks based on risk, sensitivity, and purpose
Preventing uncontrolled lateral movement

The control does not mandate a specific segmentation model. It expects deliberate, risk-based separation aligned with business need.

In-Depth Guide to Annex A 8.22

What Is Annex A 8.22 and Why Does It Matter?

In flat or poorly segmented networks:

A single compromise can spread rapidly
Malware and ransomware move laterally
Privileged access is easier to abuse
Sensitive data becomes reachable from low-risk systems

Common examples include:

User devices able to reach server networks
Guest or wireless networks connected to internal systems
Third-party connections with excessive access
Shared infrastructure hosting systems of very different sensitivity

Annex A 8.22 ensures organisations limit how far an attacker, error, or failure can travel once inside the environment.

This control replaces ISO 27001:2013 Annex A 13.1.3 and strengthens expectations around risk-based segmentation and wireless access.

How to Implement Annex A 8.22 Effectively

A pragmatic approach to Annex A 8.22 typically includes the following elements.

1. Identify Network Domains

Organisations should identify logical or physical network domains based on:

Information sensitivity
Business criticality
User type or role
System function

Typical domains may include:

User or desktop networks
Server or data networks
Management or administrative networks
Public-facing or internet-exposed zones
Guest or visitor networks

Clear definition is essential before segregation can be applied.

2. Classify Network Domains by Risk

Each network domain should be assessed based on:

Confidentiality of information handled
Impact of compromise or disruption
Exposure to untrusted users or networks

Higher-risk domains should receive:

Stronger isolation
Tighter access controls
Greater monitoring

Segmentation should follow risk — not convenience.

3. Restrict Traffic Between Network Domains

Annex A 8.22 expects organisations to control how information flows between networks.

This typically involves:

Firewalls or filtering gateways
Access control lists
Routing and switching controls

Only required traffic should be permitted.
Everything else should be blocked by default.

4. Define Clear Security Boundaries

Network boundaries should be:

Explicit
Documented
Enforced technically

Security perimeters help ensure:

Access decisions are deliberate
Controls can be tested and reviewed
Responsibility is clear

Implicit or undocumented boundaries are not defensible.

5. Apply Access Controls at Network Gateways

Where access between networks is required, controls should consider:

Who or what is accessing the destination network
The sensitivity of the destination network
The purpose and duration of access

Access decisions should align with:

Information classification
Access control policies
Business justification

Network segregation without access control is incomplete.

6. Segregate Wireless Networks Explicitly

ISO 27001:2022 places additional emphasis on wireless networks.

Organisations should consider:

Treating wireless access as external by default
Separating staff and guest wireless networks
Restricting wireless access to internal networks via gateways
Applying the same controls to guests as to staff

Wireless networks are a common entry point for attackers.

7. Separate Third-Party and Partner Connectivity

Connections to suppliers, partners, or managed service providers should be:

Segregated from internal networks
Restricted to required systems and services
Monitored and reviewed regularly

External connectivity expands the attack surface and should never be unrestricted.

8. Prevent Unauthorised Bridging Between Networks

Organisations should prevent:

Unauthorised routing or tunnelling
Dual-homed systems connecting segregated networks
Ad hoc connections that bypass gateways

Bridging often defeats segregation entirely.

9. Document Network Segregation Design

Annex A 8.22 supports maintaining documentation such as:

Network diagrams
Domain definitions
Boundary controls

Documentation supports:

Risk assessment
Incident response
Change management
Audit and assurance

If segregation exists only in people’s heads, it will fail.

10. Review Segregation After Change

Segregation should be reviewed:

After network changes
When systems are added or retired
Following incidents or near misses

Networks drift over time. Segregation must be maintained deliberately.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Practical Considerations

Annex A 8.22 does not require:

Micro-segmentation everywhere
Complex network redesign by default
Elimination of all inter-network communication

It does require organisations to:

Avoid flat, unrestricted networks
Limit lateral movement
Be able to justify why access exists

Most major breaches spread because networks allow them to.

Common Challenges and How to Overcome Them

Flat networks for convenience
Introduce risk-based segmentation

Wireless treated as internal by default
Apply explicit wireless segregation and gateways

Third-party access too broad
Restrict and monitor external connectivity

Segmentation not documented or reviewed
Maintain diagrams and review after change

Segmentation failures are architectural, not accidental.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Final Recommendations

Annex A 8.22 is about limiting how far problems can travel.

When network segregation is implemented effectively:

Attacks spread more slowly or stop entirely
Sensitive systems are better protected
Incident impact is reduced
Recovery becomes simpler and faster

You don’t prevent every compromise.
You prevent it from becoming catastrophic.

Annex A 8.22 ensures organisations design networks that contain risk by default.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

ISO 27001:2022 Annex A 8.22 – Segregation of Networks Explained

Quick Guide: Annex A 8.22 at a Glance

In-Depth Guide to Annex A 8.22

What Is Annex A 8.22 and Why Does It Matter?

How to Implement Annex A 8.22 Effectively

1. Identify Network Domains

2. Classify Network Domains by Risk

3. Restrict Traffic Between Network Domains

4. Define Clear Security Boundaries

5. Apply Access Controls at Network Gateways

6. Segregate Wireless Networks Explicitly

7. Separate Third-Party and Partner Connectivity

8. Prevent Unauthorised Bridging Between Networks

9. Document Network Segregation Design

10. Review Segregation After Change

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Practical Considerations

Common Challenges and How to Overcome Them

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Final Recommendations

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

The Annex Control Table

ISO 27001:2022 Organisational Controls

ISO 27001:2022 People Controls

ISO 27001:2022 Physical Controls

ISO 27001:2022 Technological Controls

Solutions

Quick Links

Follow Us On:

Solutions

Quick Links

Follow Us On:

Unsure where to start, lets talk!