Networks and network devices are to be secured, managed and controlled so that information in systems and applications is protected. Purpose: protect information in networks and the facilities that support it from being compromised through the network. Guidance: implement controls that secure information in networks and protect connected services from unauthorized access, considering: the kinds and classification of information the network can carry; responsibilities and procedures for managing network equipment and devices; current documentation including network diagrams and device configuration files for routers, switches and similar; where suitable, keeping network operations under different responsibility from running ICT systems (5.3); controls protecting the confidentiality and integrity of data over public, third-party or wireless networks and protecting connected systems and applications (5.22, 8.24, 5.14, 6.6), plus measures for availability of network services and connected computers; logging and monitoring that records and detects security-relevant actions (8.15, 8.16); close coordination of network management so service is optimized and controls are applied consistently across the infrastructure; authenticating systems on the network; restricting and filtering system connections, for example with firewalls; detecting, restricting and authenticating equipment and devices connecting to the network; hardening network devices; separating network administration channels from other traffic; being able to isolate critical subnetworks temporarily if the network is attacked; and disabling vulnerable network protocols. Apply suitable security to virtualized networks, including software-defined networking and SD-WAN, which can help by logically separating communications over shared physical networks, especially for distributed systems. Other information: see the ISO/IEC 27033 series and ISO/IEC TS 23167.
This control maps to 148 controls across 33 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
You are reading one control. How much of ISO 27002:2022 have you already done?
ISO 27002:2022 8.20 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.