ISO 27001 Wireless Network Security Controls

Wireless networks are one of the most exploited attack surfaces in modern organisations. They extend the corporate network perimeter beyond the physical office, introduce risks from rogue access points, and create opportunities for attackers to bypass wired security controls. ISO 27001 addresses this directly through Annex A.13 (communications security) and related controls. This article explains exactly what you need to do to secure wireless networks for ISO 27001 compliance, covering encryption, segmentation, rogue AP detection, monitoring, and remote site security.

Annex A.13 Requirements for Wireless

ISO 27001 Annex A.13 (Communications Security) contains the primary wireless-related controls, supported by Annex A.6 (organisation of information security), Annex A.8 (asset management), and Annex A.12 (operations security). Understanding how these controls apply to wireless networks is essential for a compliant implementation.

The auditor will expect to see evidence that each of these controls is addressed with specific wireless security measures, not just generic network controls. Your Statement of Applicability (SoA) should explicitly reference wireless security under each applicable control, and your risk assessment should identify wireless-specific threats such as rogue APs, evil twin attacks, and wireless eavesdropping.

Wireless Security Policy

A formal wireless security policy is the foundation of ISO 27001 compliance for wireless networks. This document must define the organisation’s approach to wireless security and provide clear standards that all users and administrators must follow.

The policy must include the following elements:

• Scope – Which wireless networks are covered (office, guest, warehouse, remote sites, IoT). The scope should include all wireless networks that carry corporate data or connect to corporate systems, including those managed by third parties.
• Authorised use – Who may connect, for what purposes, and with which devices. Personal devices (BYOD) should be subject to additional controls such as device compliance checks and containerisation.
• Technical standards – Minimum encryption (WPA3-Enterprise), authentication (802.1X/EAP-TLS), and SSID naming conventions. The policy should also specify minimum signal strength, channel selection, and frequency band preferences.
• Prohibited activities – Rogue APs, ad-hoc networks, tethering, use of personal hotspots for corporate data. Employees should be explicitly prohibited from creating wireless networks without authorisation from the IT security team.
• Review cycle – Annual policy review, plus ad-hoc reviews after major security incidents or significant changes to the wireless environment. Document the findings of each review.

The wireless security policy must be approved by management, communicated to all relevant staff through security awareness training, and referenced in the Statement of Applicability (SoA). It should also be supported by operational procedures for wireless network administration, incident response for wireless security events, and configuration standards for wireless infrastructure devices.

Encryption: WPA3 and Beyond

ISO 27001 does not mandate a specific wireless encryption standard, but it requires cryptographic controls that meet business risk requirements. In practice, this means WPA3-Enterprise is the minimum acceptable standard for 2025. The standard requires that your cryptographic controls be appropriate to the risk, and the known vulnerabilities in older standards make them difficult to justify in a risk assessment.

Here is how the encryption standards compare against ISO 27001 requirements:

If your organisation still uses WPA2, your ISO 27001 auditor will expect a documented migration plan to WPA3, with risk acceptance signed off by management for the interim period. The migration plan should include a timeline, a budget, and a process for identifying and upgrading or replacing legacy devices that do not support WPA3. For environments where WPA3 is not yet supported (e.g. some IoT devices), consider deploying these devices on a separate network segment with compensating controls such as MAC address filtering, VLAN isolation, and strict egress firewall rules.

Beyond WPA3, organisations handling highly sensitive data should consider additional cryptographic controls such as per-session encryption keys, opportunistic wireless encryption (OWE) for open SSIDs used in captive portals, and TLS 1.3 for all wireless management traffic. The use of 802.1X with EAP-TLS, where each device has a unique client certificate, is strongly recommended over EAP-PEAP or EAP-TTLS, which rely on password-based authentication that can be phished or intercepted.

Network Segmentation

Annex A.13.1.3 requires segregation of networks to protect sensitive systems. For wireless, this means you must separate your wireless traffic into logically or physically distinct zones based on the trust level and data sensitivity of each user group.

Best-practice segmentation for ISO 27001 compliance typically includes the following SSID-to-VLAN mappings:

• Corporate SSID – Authenticated users only, bridged to the corporate LAN via 802.1X. Access is restricted to authorised devices with valid certificates. Device posture checks (antivirus status, OS patch level, disk encryption) should be performed before granting network access.
• Guest SSID – Internet-only access. Traffic is firewalled from the corporate LAN. Client isolation is enforced to prevent peer-to-peer attacks between guest devices. Bandwidth throttling should be applied to prevent abuse.
• IoT / OT SSID – Separate VLAN for IoT devices (printers, sensors, cameras, building management systems). Communication with corporate systems is blocked or strictly controlled via firewall rules with application-layer inspection. IoT devices should not be able to initiate connections to corporate systems.
• DMZ SSID – Used for third-party contractors and vendors who require limited access to specific systems. Access is time-limited and logged. Contractors should be assigned to a separate VLAN with access only to the specific systems required for their work.
• BYOD SSID – For employee personal devices that need limited corporate access (email, calendar). Traffic is routed through a secure container or mobile device management (MDM) solution that enforces security policies at the application level.

Each SSID should map to a dedicated VLAN with firewall rules enforced at the network edge. VLAN hopping attacks must be mitigated by disabling Dynamic Trunking Protocol (DTP) on switch ports connected to APs, using dedicated untagged access ports, and implementing private VLANs where appropriate. Wireless controllers should be configured to tag traffic with the correct 802.1Q VLAN ID based on the SSID, and the switch ports connecting to APs should be configured as trunk ports with only the required VLANs allowed.

Guest Access

Guest wireless access is a common source of audit findings in ISO 27001 assessments. Auditors focus on three aspects: segregation, authentication, and logging. Many organisations underestimate the scrutiny that guest access receives during audits, particularly when guest access is provided in healthcare, financial services, or other regulated environments.

• Segregation – Guest traffic must never touch the corporate network. Use a dedicated SSID, separate VLAN, and firewall rules that block all RFC 1918 traffic (private IP addresses). Guest internet access should be routed through a separate internet breakout or through a firewalled connection with content filtering.
• Authentication – Guest users should authenticate via a captive portal with terms of use acceptance. SMS or voucher-based authentication is preferred for traceability. Social media login (Facebook, Google) should be discouraged unless the organisation has assessed the privacy implications and documented the risk acceptance.
• Logging – Guest access must be logged: MAC address, IP address, connection time, disconnection time, and data volume. Logs must be retained per your retention policy (typically 6–12 months). The logs should be tamper-proof and accessible only to authorised security personnel.
• Bandwidth controls – Guest access should be rate-limited to prevent abuse and to ensure sufficient bandwidth for corporate users. Typical per-user limits range from 5–10 Mbps.
• Content filtering – Implement web content filtering for guest traffic to block malicious sites and inappropriate content. This reduces the organisation’s liability for guest activities conducted on the corporate Wi-Fi network.

Do not allow guests to access internal resources by default. If limited access is required (e.g. a printer in a meeting room for guest use), create a separate VLAN with strict ACLs that permit only the specific protocols and IP addresses needed. Never place internal resources on the same VLAN as guest traffic, even with firewall rules between them.

Rogue AP Detection

Rogue access points – unauthorised APs connected to your network – are one of the most serious wireless threats. They bypass your security controls, create a backdoor into the corporate network, and can be used to intercept traffic or launch attacks against internal systems. ISO 27001 requires you to detect and respond to them under Annex A.12.6 (technical vulnerability management) and A.16.1 (incident management).

Your rogue AP detection strategy should include multiple detection methods to ensure comprehensive coverage:

• Automated wireless scanning – Deploy wireless intrusion prevention system (WIPS) sensors that continuously scan all channels for rogue APs. Modern WLAN controllers include this capability as a built-in feature. Dedicated WIPS sensors provide more comprehensive coverage and should be deployed in high-risk areas.
• Wired-side detection – Monitor switch ports for APs that should not be there. Use 802.1X and MAC address filtering as a first line of defence. Network access control (NAC) solutions can automatically detect and block unauthorised wireless devices connected to the wired network.
• Location tracking – Use triangulation or RSSI fingerprinting to locate rogue APs physically. This enables security teams to find and remove unauthorised devices quickly.
• Automated containment – WIPS should automatically contain rogue APs by sending de-authentication frames to disconnect clients and preventing them from reconnecting. The containment action should be logged and escalated to the security team.
• Incident response procedure – Define the steps for investigating, removing, and reporting rogue APs. Include escalation to the security team, documentation of findings, and remediation verification.

Your auditor will want to see logs of rogue AP detections and evidence that they were investigated and resolved within defined SLAs. Organisations with mature wireless security programmes typically target a 24-hour resolution SLA for confirmed rogue APs and a 4-hour SLA for APs that are actively being used for malicious purposes. The incident response procedure should also include a post-incident review to identify how the rogue AP was connected and to implement preventive measures.

Wireless Monitoring

Continuous monitoring of your wireless environment is required under Annex A.12.6 (technical vulnerability management) and A.16.1 (incident management). Monitoring should cover both security events and operational performance, as degraded wireless performance can be an early indicator of a security issue (e.g. interference from a rogue AP or a de-authentication flood attack).

All monitoring activities should be documented in procedures, and the results should be reported to the ISMS management review. Any security events identified through wireless monitoring should be entered into the incident management process and tracked to resolution. Automated alerting should be configured for critical events such as rogue AP detection, WPA3 downgrade attacks, and mass de-authentication events that indicate a possible denial-of-service attack.

Remote Site Security

Remote offices, branch sites, and home workers present additional wireless security challenges. Your ISO 27001 ISMS must extend to these locations, and the same standards that apply at headquarters should apply everywhere. However, the implementation may differ based on the resources available at each location and the level of risk.

• Branch offices – Deploy the same wireless security standards as head office: WPA3-Enterprise, 802.1X, and centralised WLAN management. Never allow locally-managed APs at branch offices. Centralised management ensures consistent policy enforcement, firmware updates, and monitoring across all locations. SD-WAN integration can enforce consistent wireless security policies across all sites from a central controller.
• Home workers – Corporate devices must connect via VPN for all work-related traffic. Home Wi-Fi should meet a minimum security standard (WPA2 as a minimum, ideally WPA3). Provide clear home Wi-Fi security guidance to employees, including instructions for changing default router passwords, enabling encryption, and updating firmware. Consider issuing corporate wireless routers to employees who handle sensitive data.
• Co-working spaces – Employees should never connect directly to co-working Wi-Fi for corporate applications. A cellular hotspot with corporate VPN is the recommended approach. If a hotspot is not available, employees should use the co-working Wi-Fi only for internet connectivity and always maintain an active VPN connection.
• Temporary locations – For events, pop-up offices, or temporary project sites, deploy portable APs that connect to the corporate network via a secure VPN tunnel. The AP should be configured with the same security standards as permanent locations and should be decommissioned immediately after use.

All remote locations should be included in the ISMS scope documentation. The risk assessment should consider the specific threats associated with each type of remote location, and the risk treatment plan should identify the controls that are in place to mitigate those threats. Regular auditing of remote site wireless security should be incorporated into the internal audit programme.

Frequently Asked Questions

Does ISO 27001 require WPA3?

Not explicitly, but in practice, yes. The standard requires cryptographic controls appropriate to the risk. WPA2-Personal is no longer considered acceptable for any environment handling sensitive data. WPA3-Enterprise is the baseline for ISO 27001 compliance from 2025. If your risk assessment identifies wireless eavesdropping or unauthorised access as plausible threats (which they almost always are), WPA3 is the only standard that provides adequate assurance against current attack techniques.

Can we have a single SSID for staff and guests?

No. Annex A.13.1.3 requires network segregation. Staff and guest traffic must be separated at the network layer. Using a single SSID with VLAN assignment via 802.1X is technically possible but still breaches the segregation requirement if both user types share the same broadcast domain. Use separate SSIDs with separate VLANs and firewall rules between them.

How often should we scan for rogue APs?

Continuous scanning is the standard for ISO 27001 compliance. Automated WIPS sensors should scan all channels 24/7. If continuous scanning is not feasible (e.g. in a very small office), weekly manual scans using a handheld spectrum analyser are the minimum, though this carries higher risk and should be documented with risk acceptance from management.

Do we need to log individual user wireless activity?

Yes. Annex A.12.4 (logging and monitoring) requires that user activities are logged. For wireless, this means capturing association and disassociation events, authentication successes and failures, and data volumes per user. Logs must be retained for the period defined in your log retention policy and protected against tampering and unauthorised access.

What does an ISO 27001 auditor look for during a wireless review?

The auditor will request your wireless security policy, review the Statement of Applicability for relevant controls, inspect your encryption configuration on the wireless controller, check for evidence of network segregation between staff and guest traffic, examine rogue AP detection logs, verify that wireless monitoring is operating effectively, and review the results of any wireless penetration tests. They may also walk the office with a spectrum analyser to spot unauthorised APs or check for signal leakage outside the building perimeter.

Can we use cloud-managed wireless and still be ISO 27001 compliant?

Yes, provided the cloud management platform holds ISO 27001 certification itself and your contract includes a data processing agreement (DPA) that addresses Annex A.13 requirements. You must also ensure that management traffic between your APs and the cloud controller is encrypted with TLS 1.2 or higher, and that the cloud provider stores your configuration and logs in a region that complies with your data localisation requirements.

Strengthen Your Wireless Security for ISO 27001

Wireless networks are a critical part of your information security perimeter. They are also one of the most common areas where ISO 27001 audits identify non-conformities. Our ISO 27001 consultants can assess your current wireless controls against Annex A.13 requirements, identify gaps, and help you implement the measures needed for a successful certification audit. We provide wireless security gap assessments, policy development, configuration reviews, and auditor preparation support.