8.22 Segregation of networks
Requires segregation within the organisation's networks, keeping groups of information services, of users and of systems apart from one another.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of segregation for wireless, guest, third party, management and operational technology networks · Vendor register / contract repository
- Testing evidence confirming the segregation holds, such as segmentation testing results · Cloud console / configuration management
- Records of exceptions crossing zone boundaries, with approval and review · Cloud console / configuration management
governing documentDocuments that govern the control
- The segregation design, showing the defined zones and the criteria placing systems, services and users into each · Policy repository / GRC workspace
- Enforcement evidence at each boundary, such as firewall rules, access control lists or micro segmentation policy · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Segregation designed and undermined by broad permit rules between zones that were added for a project and never removed
- Management networks flat and reachable, which converts a single compromise into full estate access
- Segregation never tested, so the design and the enforced reality are unverified
- Guest and third party access bridged into internal segments by shared infrastructure
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet