Operations, logging and vulnerability ยท question family
Network security and segmentation: the clause the question tests
How the service's network is divided and guarded at its edges.
How the customer usually asks it
example"Are production networks segmented and protected by firewalls?"
Anchor clauses
1 framework| Framework | Anchor clause |
|---|---|
| ISO/IEC 27001:2022 | 8.20 Networks security |
Every framework that anchors this family is listed here; a register shows the ones ticked for the customer.
Evidence expected
The network diagram for the service, the segmentation between environments, and the last firewall rule review.
The clauses, with what an assessor asks for
ISO 27001 8.20 Networks securitySecure, manage and control networks and network devices.
Evidence an assessor expects: Network topology diagrams; Firewall rule sets; Network access control lists; Wireless security configurations
Where answers usually fall short: Outdated topology diagrams; Inconsistent firewall rule documentation
Source: ISO/IEC 27001:2022
Where answers usually fall short: Outdated topology diagrams; Inconsistent firewall rule documentation
Source: ISO/IEC 27001:2022