8.21 Security of network services
For each network service, the organization is to identify, put in place and monitor the security mechanisms, the service levels and the requirements that apply. Purpose: make using network services safe. Guidance: identify and implement the security measures a given service needs, including security features, service levels and requirements, whether it is provided internally or externally, and make sure providers implement them. Determine and regularly monitor each provider's ability to manage the agreed services securely, agree a right to audit, and consider third-party attestations from providers showing they maintain appropriate security. Rules for using networks and network services should cover which networks and services may be accessed; authentication requirements for each service; authorization procedures deciding who may reach which networks and services; management, technical controls and procedures protecting access to network connections and services; the means of access, such as VPN or wireless; the user's time, location and other attributes at access; and monitoring of service use. Security features to consider include the technologies securing the service, such as authentication, encryption and connection controls; the technical parameters needed for a secure connection under the security and connection rules; caching, for example in content delivery networks, with parameters that let users choose caching according to performance, availability and confidentiality needs; and usage procedures that limit who may reach particular services or applications when needed. Network services range from simple unmanaged bandwidth to connections, private network services and managed security services such as firewalls and intrusion detection; ISO/IEC 29146 gives an access management framework.
Source: ISO/IEC 27002:2022, 8.21. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Monitoring reports on provider performance against agreed security and service levels · SIEM / log platform
- Documented rules on permitted networks and services, authentication, authorization, means of access (VPN, wireless) and contextual conditions · Identity provider / directory
periodic reviewEvidence produced at each review
- Right-to-audit clauses and third-party attestations from network and managed security service providers, with records of review · Vendor register / contract repository
governing documentDocuments that govern the control
- Service agreements with internal and external network providers specifying security features, service levels and requirements · Vendor register / contract repository
- Technical parameters for secure connections, such as encryption and connection control settings, and caching decisions for CDN services · Vendor register / contract repository
First move
Common gaps auditors find
- Network service contracts specify bandwidth and uptime but no security requirements
- Managed security providers are never audited and attestation reports are not reviewed
- No rules define which networks users may connect to or how
- CDN caching settings expose confidential content
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet