A.8.22 Segregation of networks
Segregate groups of services, users and systems in the network.
12
artefacts
3
held by a system
3
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Export of perimeter firewall rule base · Cloud console / configuration management
- Internal firewall rule set for DMZ and internal zones · Cloud console / configuration management
- Change log of firewall rule modifications · SIEM / log platform
periodic reviewEvidence produced at each review
- Network segmentation penetration test report · Vulnerability scanner / patch tooling
- Internal VLAN isolation test results · Source control / CI pipeline
- Third‑party network segregation audit report · Cloud console / configuration management
governing documentDocuments that govern the control
- Network Segmentation Policy document · Policy repository / GRC workspace
- Network Segmentation Standard operating procedures · Policy repository / GRC workspace
- Change Management Procedure for network zones · Policy repository / GRC workspace
- Logical network diagram showing VLAN assignments · Policy repository / GRC workspace
- Physical network diagram with firewalls, routers and switches · Policy repository / GRC workspace
- Zone-to-zone connectivity matrix · Policy repository / GRC workspace
First move
Start with the 3 of 12 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Informal or outdated network maps used instead of documented diagrams
- Inconsistent VLAN tagging and naming across locations
- Exceptions to segmentation not recorded or approved
- Segregation controls rarely tested after changes
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet