8.21 Security of network services
Requires the security mechanisms for network services, along with their service levels and the requirements placed on them, to be identified, implemented and monitored, whether provision is in house or outsourced.
5
artefacts
1
held by a system
1
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Monitoring evidence showing service levels and security requirements are actually being met · SIEM / log platform
periodic reviewEvidence produced at each review
- Evidence of implementation of those mechanisms, such as encryption, authentication and connection controls · Identity provider / directory
governing documentDocuments that govern the control
- Identification of network services in use, whether in house or outsourced, with their owners · Vendor register / contract repository
- The security mechanisms, service levels and management requirements defined for each service · Policy repository / GRC workspace
- Agreements with network service providers containing the security requirements, and evidence of assurance obtained · Vendor register / contract repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Requirements defined for internal services while carrier and internet provider services carry only commercial terms
- Service levels monitored for availability while the security requirements attached to them are never verified
- Assurance from providers accepted as a certificate with no check that the purchased service is in scope
- Legacy circuits and connections still live with no owner and no defined requirement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet