---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.8.20"
title: "Networks security"
theme: Technological
control_type:
  - Preventive
  - Detective
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts:
  - Protect
  - Detect
operational_capabilities: [System_and_network_security]
security_domains: [Protection]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 8.20 Networks security

  

### Control
Networks and network devices should be secured, managed and controlled to protect information in systems and applications.

### Purpose
To protect information in networks and its supporting information processing facilities from compromise via the network.

### Guidance
Controls should be implemented to ensure the security of information in networks and to protect connected services from unauthorized access. In particular, the following items should be considered:

a\) the type and classification level of information that the network can support;

b\) establishing responsibilities and procedures for the management of networking equipment and devices;

c\) maintaining up to date documentation including network diagrams and configuration files of devices (e.g. routers, switches);

d\) separating operational responsibility for networks from ICT system operations where appropriate (see [5.3](a-5.3-Segregation-of-duties.md));

e\) establishing controls to safeguard the confidentiality and integrity of data passing over public networks, third-party networks or over wireless networks and to protect the connected systems and applications (see >5.22>, >8.24>, >5.14and >6.6>). Additional controls can also be required to maintain the availability of the network services and computers connected to the network;

f\) appropriately logging and monitoring to enable recording and detection of actions that can affect, or are relevant to, information security (see >8.16and >8.15>);

g\) closely coordinating network management activities both to optimize the service to the organization and to ensure that controls are consistently applied across the information processing infrastructure;

h\) authenticating systems on the network;

i\) restricting and filtering systems connection to the network (e.g. using firewalls);

j\) detecting, restricting and authenticating the connection of equipment and devices to the network;

k\) hardening of network devices;

l\) segregating network administration channels from other network traffic;

m\) temporarily isolating critical subnetworks (e.g. with drawbridges) if the network is under attack;

n\) disabling vulnerable network protocols.

The organization should ensure that appropriate security controls are applied to the use of virtualized networks. Virtualized networks also cover software-defined networking (SDN, SD-WAN). Virtualized networks can be desirable from a security viewpoint, since they can permit logical separation of communication taking place over physical networks, particularly for systems and applications that are implemented using distributed computing.

### Other information
Additional information on network security can be found in the ISO/IEC 27033 series. More information concerning virtualized networks can be found in ISO/IEC TS 23167.