ISO 27001 Network Security: Controls and Best Practices

ISO 27001 network security controls are essential for protecting your organisation’s information as it travels across internal and external networks. Annex A.13 of ISO 27001:2022 provides a comprehensive framework for network security management, covering segregation, service agreements, authentication, and monitoring. This article covers every control and how to implement them in practice.

Understanding Annex A.13 – Communications Security

Annex A.13 is divided into two sections: Network Security Management (A.13.1) and Information Transfer (A.13.2). Together they cover everything from VLAN configuration to secure file transfer agreements with third parties.

Network Segregation: VLANs and Zones

Control A.13.1.3 requires segregation in networks. This means that traffic from different trust levels should not share the same broadcast domain without filtering. The most common implementation is a zoned architecture:

Segregation should be enforced at Layer 2 (VLANs) and Layer 3 (firewall rules and ACLs). Every inter-zone traffic flow must be justified and documented. Deny-all-by-default should be the baseline rule for every firewall in your environment.

Firewall Configuration and Management

Firewalls are the primary enforcement point for network controls (A.13.1.1). A compliant firewall implementation includes:

• Change control: Every rule change must be requested, reviewed, tested, and approved. Maintain a firewall change log with justification and risk assessment for each rule.
• Rule review: Review all firewall rules at least quarterly and remove any that are unused or expired. Stale rules are a major security risk.
• Default deny: All traffic is denied unless an explicit rule permits it. There should be no catch-all permit rules.
• Logging: Enable logging on all permit and deny rules. Forward logs to a central SIEM for analysis and alerting.
• High availability: Deploy firewalls in active/passive or active/active pairs to avoid a single point of failure.

VPNs and Remote Access Security

With remote and hybrid working now standard, VPN security is a critical part of Annex A.13 compliance. Your VPN implementation should meet these requirements:

• Strong encryption: Use at least AES-256 for data in transit. Disable legacy protocols such as PPTP and SSLv3.
• Multi-factor authentication (MFA): VPN access must require MFA for every user. This is non-negotiable and is one of the most effective controls you can deploy.
• Split tunnelling: Restrict split tunnelling so that all corporate traffic (including internet-bound) routes through the VPN and is inspected.
• Device compliance: Use Network Access Control (NAC) to check that connecting devices have up-to-date antivirus, patches, and disk encryption before granting VPN access.
• Session timeout: Set idle session timeouts (e.g. 30 minutes) and maximum session durations (e.g. 12 hours).

Network Monitoring and Intrusion Detection

Control A.13.1.1 also requires monitoring. You cannot secure what you cannot see. A robust network monitoring architecture includes:

• Network traffic analysis: Monitor bandwidth utilisation, protocol distribution, and top talkers to detect anomalies.
• Intrusion Detection/Prevention Systems (IDS/IPS): Deploy at the network perimeter and between internal zones. Signature-based detection covers known threats; behaviour-based detection catches zero-day activity.
• SIEM integration: Aggregate logs from firewalls, switches, servers, and endpoints. Use correlation rules to generate alerts for suspicious patterns (e.g. a workstation making DNS requests to a known C2 domain).
• NetFlow/IPFIX: Collect flow data to identify lateral movement and data exfiltration attempts.
• Alert response SLA: Define response times for critical, high, and medium alerts and verify them through tabletop exercises.

Security of Network Services

Control A.13.1.2 addresses outsourced network services such as MPLS, SD-WAN, and managed firewalls. If you use a third party to deliver any network service, you must:

• Include security requirements in the service level agreement (SLA).
• Agree on incident response procedures and reporting timelines.
• Define security metrics that the provider must report (e.g. uptime, patch status, breach notifications).
• Conduct periodic audits or review independent audit reports (such as SOC 2).

Secure Information Transfer Agreements

Control A.13.2.2 requires formal agreements when transferring information to external parties. This applies to data shared with customers, suppliers, regulators, and partners. Each agreement should specify:

• The classification of information being shared.
• Required encryption standards for transit and at rest.
• Permitted methods of transfer (e.g. SFTP, encrypted email, API with TLS 1.3).
• Notification requirements in the event of a breach.
• Data retention and deletion timelines.

Frequently Asked Questions

Do we need to segregate our network even if we are a small business?

Yes. At minimum, you should have three zones: guest Wi-Fi isolated from the corporate network, a separate server VLAN, and a management VLAN. The effort is low (a VLAN-aware switch costs a few hundred dollars) and the risk reduction is substantial.

What is the difference between A.13.1.1 and A.13.1.3?

A.13.1.1 (Network controls) is the overarching control covering firewalls, monitoring, and traffic filtering. A.13.1.3 (Segregation in networks) is a specific sub-control that requires traffic from different trust levels to be isolated. Think of A.13.1.1 as “secure the network” and A.13.1.3 as “separate the network”.

How often should we review firewall rules?

At least quarterly. Many organisations conduct monthly reviews for critical firewalls. Every rule should have an owner, a business justification, and an expiry date. Automated firewall analysis tools can flag unused, overlapping, or overly permissive rules.

Is it acceptable to use cloud-based network security controls?

Yes. ISO 27001 is technology-neutral. A cloud firewall (e.g. AWS Security Groups, Azure Firewall) or cloud-based SD-WAN can fully satisfy Annex A.13 controls as long as they are configured and managed correctly. Ensure your cloud provider’s shared responsibility model is documented.

What records does an ISO 27001 auditor look for under Annex A.13?

Your auditor will ask for: the network architecture diagram showing zones and segregation; firewall rule sets and change logs; VPN configuration and MFA policies; IDS/IPS alert logs and response records; network monitoring reports; and information transfer agreements with third parties.

Do we need to encrypt all internal network traffic?

Not all, but you should encrypt traffic that crosses trust boundaries (e.g. between VLANs) and all traffic containing personal or confidential data. In practice this means encrypting server-to-server API calls, database connections, and any traffic that crosses a network zone boundary.

Get Expert Help with ISO 27001 Network Security

Network security controls can be complex to implement and even harder to maintain. Whether you need a network architecture review, firewall policy design, or a full Annex A.13 gap analysis, our ISO 27001 consultants can help.

Prefer instant support? Chat with us on WhatsApp.