ISO 27001 Annex A 8.20 Network and network devices security
What it says
Networks and network devices shall be secured, managed and controlled to protect information in systems and applications.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSecure and manage networks to prevent unauthorised access to your information.
Imagine your network like your home; if doors and windows are left open, intruders could easily get in and steal your valuables. This control is about making sure that your business's network and its devices are well-guarded. If not, unauthorised people could access sensitive information, potentially harming your reputation and causing financial loss.
Free. Save your status, tasks and notes.
Why it matters
Weak network and device security enables unauthorised access, traffic interception and lateral movement, leading to data breaches and reputational damage.
How to implement
The IT Manager should classify the information passing through the network by identifying the types of data being handled and understanding their sensitivity.
This can be done by conducting an information audit, which is a systematic examination of the data to see how it's used and who needs access.
The IT Manager needs to maintain up-to-date documentation of the network setup, including diagrams and device configurations.
This involves regularly updating network diagrams and keeping records of settings on each device like routers and switches, which helps in identifying gaps and changes in security.
The Board should ensure policies are in place for managing network devices, by assigning clear responsibilities for updates and security monitoring.
Implement procedures for regular system checks, including scheduling updates and defining emergency protocols for device issues.
Procurement and IT departments should work together to ensure network devices are hardened by disabling unused services and applying security patches.
This involves setting up a routine schedule for testing and applying updates, ensuring devices like routers cannot be easily exploited.
The IT Manager should implement logging and monitoring systems to detect any unusual network activity.
This can be done by setting up alerts for suspicious activities and keeping a historical record of network traffic flow to quickly spot and respond to threats.
Keep it running
Harden routers/switches/firewalls, restrict admin access (MFA, least privilege), patch firmware, segment networks, and monitor logs/traffic for anomalies.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network documentation, including diagrams and configuration files.
Look at
The completeness of diagrams and currency of configuration files. Good documentation will be detailed, showing network layout and current configurations, regularly updated to reflect changes.
- Check 2 of 5What an auditor asks for
Look at
How roles and responsibilities are assigned and documented.
Good evidence
Policy is one where all devices have clear ownership and update protocols are well-defined.
- Check 3 of 5What an auditor asks for
Ask for
Logs of network monitoring activities.
Look at
The logs for recent months to check for unusual or unauthorised access attempts. Good logging should include recent activities, flag unusual patterns, and have protocols for responding to alerts.
- Check 4 of 5What an auditor asks for
Look at
Whether unnecessary services are disabled and security settings are up to date.
Good evidence
Will show detailed reports on security settings, updated regularly according to changes and threats.
- Check 5 of 5What an auditor asks for
Ask for
Incident response records related to network security events.
Look at
The documentation of identified issues and subsequent actions taken. Good records will show a clear process of detection, reporting, and resolution of network incidents.
Mappings
Closest match in ASD Information Security Manual: ISM-0245, Prevent MFD connections to digital phone systems, which this control covers in full and more.
ASD Information Security Manual: 101 mappings
This control is broader than ISM-0245.
ISM-0245 requires that multifunction devices (MFDs) are not connected to digital telephone systems to remove an insecure or unnecessary communications pathway. Annex A 8.20 requires networks and network devices to be secured and controlled, which includes designing and enforcing permitted/blocked network interconnections. ISM-0245 is a specific network-segmentation/connection-prohibition implementation, while Annex A 8.20 is broader and covers overall network security management beyond telephony connections.
This control is broader than ISM-0263.
Annex A 8.20 requires secure control of networks, including the use of security devices and controls that protect information traversing network boundaries. ISM-0263 relates by requiring TLS traffic through gateways to be decrypted and inspected, enabling detection and prevention of threats hidden in encrypted flows. Annex A 8.20 is broader because it addresses overall network and device security management, while ISM-0263 is a specific gateway traffic inspection requirement with privacy and architecture implications.
This control is broader than ISM-0467.
ISM-0467 requires HACE for SECRET and TOP SECRET data on insecure networks. Annex A 8.20 mandates securing and managing networks and devices. Implementing HACE specifically strengthens communication security for classified data in untrusted conditions, complementing the broader network security control in Annex A 8.20.
This control is broader than ISM-0469.
ISM-0469 requires that an ASD-Approved Cryptographic Protocol (or high assurance cryptographic protocol) is used to protect data when it is communicated over network infrastructure. This relates to Annex A 8.20 because securing and controlling networks and network devices commonly includes enforcing strong, approved cryptographic protocols (e.g., TLS/IPsec) for data-in-transit protection. Annex A 8.20 is broader, covering many other network security controls (segmentation, device hardening, monitoring) beyond cryptographic protocol selection.
This control is broader than ISM-0484.
Annex A 8.20 requires network devices and the services used to manage them to be secured to prevent unauthorised access and protect information. ISM-0484 directly relates by specifying secure SSH daemon configuration settings that harden remote administration channels and reduce the risk of compromise. Annex A 8.20 is broader because it covers many other network device security measures beyond SSH configuration hardening.
This control is broader than ISM-0494.
ISM-0494 requires organisations to use IPsec tunnel mode for IPsec connections, and if transport mode is used, to implement an IP tunnel to preserve appropriate security properties. This relates to Annex A 8.20 because securing and controlling networks and network devices includes selecting and enforcing secure network encryption and tunnelling methods for inter-network connectivity (e.g. VPN architectures). Annex A 8.20 is broader and technology-agnostic as it covers many network security controls, while ISM-0494 is a specific prescriptive requirement about IPsec mode selection and tunnelling.
This control is broader than ISM-0516.
ISM-0516 requires organisations to maintain comprehensive network diagrams that show inbound/outbound connections and the placement of critical servers and security appliances. Annex A 8.20 focuses on securing, managing and controlling networks and network devices, and accurate diagrams from ISM-0516 support this by enabling correct identification of network boundaries, device roles, and security control points. Annex A 8.20 is about technical and operational security of networks, whereas ISM-0516 is about documentation that facilitates those activities.
This control is broader than ISM-0520.
ISM-0520 requires network access controls that block unauthorised network devices from connecting. Annex A 8.20 covers securing, managing and controlling networks and network devices more generally, which includes (but is not limited to) controlling which devices may connect. ISM-0520 is a specific subset of Annex A 8.20 focused on unauthorised device connection prevention rather than the full range of network security controls.
This control is broader than ISM-0529.
ISM-0529 requires that VLANs are not used to separate network traffic between different security domains, pushing organisations to use stronger separation mechanisms for domain boundaries. Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information, which includes applying appropriate architectural controls to prevent cross-domain compromise. ISM-0529 supports Annex A 8.20 by reducing the risk of misconfiguration or bypass of logical separation where security domain separation is required, but Annex A 8.20 is much broader than segmentation choices alone.
This control is broader than ISM-0530.
ISM-0530 requires that network devices used to manage VLANs are administered only from the most trusted security domain. This relates directly to Annex A 8.20, which requires organisations to secure, manage and control networks and network devices to protect information. ISM-0530 is a specific administrative-access restriction for VLAN management, whereas Annex A 8.20 is broader and covers network/device security generally (including monitoring, hardening, and management controls beyond admin-origin).
This control is broader than ISM-0534.
Annex A 8.20 requires network devices to be secured and controlled to prevent unauthorised access to information and services. ISM-0534 relates by requiring unused physical ports on network devices to be disabled, reducing attack surface and preventing unauthorised connectivity. Annex A 8.20 is broader because it includes many other device and network security controls beyond physical port state management.
This control is broader than ISM-0546.
ISM-0546 requires a video-aware or voice-aware firewall or proxy wherever video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy. This is a specific control on how network devices inspect and control real-time media traffic, making it one implementation of the Annex A 8.20 requirement that networks and network devices be secured, managed and controlled. Annex A 8.20 addresses network security broadly, while ISM-0546 applies only to video and voice traffic at gateways.
This control is broader than ISM-0551.
ISM-0551 focuses on securing IP telephony network access by authenticating endpoints to the call controller, preventing auto-registration, and disabling unused/prohibited functionality. This relates to Annex A 8.20 because call controllers, voice VLANs, and IP phones are network devices/services that need to be managed and controlled to protect information and services. Annex A 8.20 is broader and covers overall network and network device security beyond telephony registration controls and feature lockdown.
This control is broader than ISM-0558.
ISM-0558 requires public area IP phones to be configured so they cannot reach internal data networks or associated services like voicemail and directories. Annex A 8.20 requires networks and network devices to be secured, managed, and controlled, which typically includes hardening switch ports, applying ACLs, and controlling routing between voice and data networks. ISM-0558 is a specific restriction for a particular device/location scenario, while Annex A 8.20 is a broader requirement covering overall network/device security management.
This control is broader than ISM-0569.
Annex A 8.20 requires secure management and control of network architecture and traffic handling to protect information in systems and applications. ISM-0569 supports this by routing email via centralised email gateways, enabling consistent enforcement of security controls (e.g. filtering, inspection and logging) over a key communications flow. Annex A 8.20 is broader because it covers all network segments and devices, not only email routing design.
This control is broader than ISM-0572.
ISM-0572 requires opportunistic TLS to be enabled on email servers for inbound and outbound connections over public network infrastructure to protect email in transit. Annex A 8.20 requires networks and network devices to be secured and controlled to protect information in systems and applications, which includes configuring secure transport for services such as SMTP. ISM-0572 is a specific technical configuration for one service (email transport), whereas Annex A 8.20 is broader and covers security controls across all network services and devices.
This control is broader than ISM-0622.
ISM-0622 requires IT equipment to authenticate to other networks that are accessed via gateways, focusing on device-to-network identity assurance at trust boundaries. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which commonly includes enforcing authenticated access between network segments and at gateways. Annex A 8.20 is broader because it covers the full range of network security management (configuration, monitoring, administration and controls), not just authentication of IT equipment traversing gateways.
This control is broader than ISM-0628.
ISM-0628 requires gateways between different security domains to enforce controlled and secure traffic flows across domain boundaries. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes secure configuration and operation of boundary devices such as routers, firewalls and gateway appliances. Annex A 8.20 has a wider scope across all network devices and management practices, whereas ISM-0628 is specifically about implementing the inter-domain gateway itself.
This control is broader than ISM-0629.
ISM-0629 requires that for gateways between different security domains, any shared components are administered by the higher security domain's administrators or an agreed trusted third party. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes secure administration and governance of devices such as domain gateways. Annex A 8.20 is broader across all network devices, while ISM-0629 is a specific governance rule about who manages shared gateway components between domains.
This control is broader than ISM-0631.
ISM-0631 requires gateways to only allow explicitly authorised data flows and to block all other transfers. This aligns with Annex A 8.20 because securing and controlling networks and network devices commonly includes implementing gateway controls (e.g., firewalls, proxies, secure gateways) that enforce permitted traffic flows. Annex A 8.20 is broader as it covers overall network/device security management beyond authorised flow allow-listing, while ISM-0631 is specific to gateway-enforced data flow authorisation.
This control is broader than ISM-0639.
ISM-0639 addresses high-assurance evaluation and use of firewalls/diode gateways between different security domains. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes securing boundary devices that enforce domain separation. Annex A 8.20 is broader device/network security governance, whereas ISM-0639 is a specific assurance constraint on the type/assurance level of gateway used for cross-domain connections.
This control is broader than ISM-0643.
ISM-0643 requires organisations to use evaluated diodes to enforce one-way data flow in unidirectional gateways between internal networks and public network infrastructure. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include implementing one-way gateways/diodes as a network-device security mechanism for high-assurance boundary protection. ISM-0643 is a specific, technology-prescriptive control for a particular gateway pattern, while Annex A 8.20 is broader and allows many alternative network security controls.
This control is broader than ISM-0874.
ISM-0874 requires endpoints to use an organisation-controlled internet gateway for outbound internet access, preventing unmanaged direct internet connections. ISO/IEC 27001:2022 Annex A 8.20 broadly requires networks and network devices to be secured, managed and controlled, which includes controlling egress paths and gateway devices. ISM-0874 is a specific network security design rule that would typically be implemented as part of the broader Annex A 8.20 requirement.
This control is broader than ISM-1006.
Annex A 8.20 requires networks and network devices to be secured and controlled, including protection of administrative and management planes. ISM-1006 directly supports this by requiring measures to prevent unauthorised access to network management traffic, reducing the risk of device takeover and configuration tampering. Annex A 8.20 is broader as it covers all network traffic and device security controls, not only management-plane traffic protections.
This control is broader than ISM-1028.
Annex A 8.20 addresses securing and controlling networks and network devices across the environment to protect information in systems and applications. ISM-1028 requires deploying NIDS/NIPS in gateways between organisational networks and networks not managed by the organisation, providing detection/prevention at key boundaries. This is a specific implementation of network security within the broader Annex A 8.20 control set, which also includes device configuration, segmentation, and network service governance beyond gateway IDS/IPS deployment.
This control is broader than ISM-1030.
Annex A 8.20 requires networks to be secured, managed and controlled, which includes monitoring and detecting unauthorised or policy-violating network activity. ISM-1030 supports this by requiring a NIDS/NIPS inside the outermost firewall for gateways and alerting on traffic that contravenes firewall rules, strengthening detection and response for perimeter control failures. Annex A 8.20 is broader because it covers overall network security, whereas ISM-1030 is a specific monitoring placement and configuration requirement.
This control is broader than ISM-1085.
ISM-1085 requires mobile devices to encrypt sensitive or classified data when it is communicated over public network infrastructure. Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information in systems and applications, which includes implementing secure network services (e.g. VPNs, secure Wi-Fi, and secure remote access) that mobile devices rely on when traversing public networks. Annex A 8.20 is broader and network-centric, while ISM-1085 is a specific endpoint transmission-encryption requirement for mobile devices over public networks.
This control is broader than ISM-1157.
ISM-1157 requires evaluated diodes to control the data flow of unidirectional gateways between networks. This is a specific way of controlling traffic between networks using an assured network device, and so is one implementation of the Annex A 8.20 requirement that networks and network devices be secured, managed and controlled. Annex A 8.20 is much broader, covering network security management in general rather than a single gateway technology.
This control is broader than ISM-1158.
ISM-1158 requires that network diodes used to enforce one-way data flow in unidirectional gateways between SECRET/TOP SECRET networks and any other networks have completed a high assurance evaluation. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes selecting appropriate security-enforcing network components and assuring they are fit for purpose. ISM-1158 is a highly specific assurance requirement for a particular network device and classified cross-domain scenario, while Annex A 8.20 is a broad control covering network/device security generally.
This control is broader than ISM-1182.
ISM-1182 requires limiting the flow of network traffic within and between network segments to only what is required for business purposes. Annex A 8.20 requires networks and network devices to be secured, managed and controlled more generally to protect information in systems and applications. ISM-1182 is a specific subset of Annex A 8.20 focused on traffic-flow control (e.g., segmentation enforcement, ACLs, firewall policy) rather than all aspects of network/device security management.
This control is broader than ISM-1192.
ISM-1192 requires gateways to inspect and filter data flows at the transport layer and above to control what traverses network boundaries. This relates directly to Annex A 8.20, which requires networks and network devices to be secured, managed and controlled, including use of security capabilities such as secure gateways and filtering controls. Annex A 8.20 is broader because it covers overall network/device security management, including configuration, segmentation, hardening and monitoring, whereas ISM-1192 focuses specifically on gateway inspection and filtering behaviour.
This control is broader than ISM-1270.
ISM-1270 requires a concrete network architecture outcome: database servers are separated onto a different network segment from user workstations. This relates to Annex A 8.20 because securing and controlling networks and network devices commonly includes designing segmentation and enforcing traffic controls between segments. Annex A 8.20 is broader and includes many other network security measures (e.g. device hardening, secure management, and monitoring), while ISM-1270 is focused specifically on segmentation placement for database servers.
This control is broader than ISM-1271.
ISM-1271 requires network access controls that restrict database server communications to strictly defined network resources that need access. Annex A 8.20 requires organisations to secure, manage and control networks and network devices to protect information in systems and applications, which includes implementing filtering, firewalling and controlled routing. ISM-1271 is a specific application of network security management focused on database server connectivity, whereas Annex A 8.20 covers network/device security more broadly across the environment.
This control is broader than ISM-1304.
ISM-1304 requires default user accounts or credentials on network devices (including pre-configured accounts) to be changed, disabled or removed during initial setup. Annex A 8.20 requires networks and network devices to be secured, managed, and controlled, including hardening activities such as removing default credentials. Annex A 8.20 addresses a broader scope of network device security lifecycle controls, while ISM-1304 is a focussed hardening requirement for default credentials.
This control is broader than ISM-1311.
ISM-1311 requires organisations to prevent the use of insecure SNMP versions (SNMPv1 and SNMPv2) on networks. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which would include enforcing secure management protocols and disabling weak ones such as SNMPv1/v2. Annex A 8.20 is broader because it encompasses overall network/device security beyond SNMP protocol version selection.
This control is broader than ISM-1312.
Annex A 8.20 requires organisations to secure and control network devices to prevent unauthorised access and protect information flows. ISM-1312 relates directly by requiring default SNMP community strings on network devices to be changed and write access disabled, preventing unauthorised device monitoring or configuration changes. Annex A 8.20 is broader as it includes the full range of device hardening and network management controls, not just SNMP.
This control is broader than ISM-1314.
ISM-1314 requires that all wireless devices used by the organisation are Wi‑Fi Alliance certified. This is a specific procurement/allowlisting constraint that contributes to Annex A 8.20 (Network and Network Devices Security) by reducing the likelihood of deploying wireless network devices with non-standard or weak security capabilities. Annex A 8.20 is broader because it covers the full lifecycle of securing, managing and controlling networks and network devices (including configuration, monitoring and access controls), while ISM-1314 only addresses a certification attribute for wireless devices.
This control is broader than ISM-1315.
ISM-1315 requires organisations to disable the administrative interface on wireless access points for wireless network connections, preventing wireless-based management access. This relates to Annex A 8.20 because securing and controlling network devices includes hardening management planes and restricting how administration can occur on devices such as wireless access points. Annex A 8.20 is broader as it covers security management and control of networks and all network devices generally, not this specific wireless administrative-interface restriction.
This control is broader than ISM-1316.
Annex A 8.20 requires organisations to secure and control networks and network devices, including configuration management of access technologies such as Wi-Fi. ISM-1316 supports this by requiring default wireless SSIDs to be changed, reducing predictable identifiers that can assist targeting and poor default configurations. Annex A 8.20 is broader because SSID changes are only one small element of wireless network hardening and overall network security management.
This control is broader than ISM-1317.
ISM-1317 requires that SSIDs for non-public wireless networks are named so they are not readily associated with the organisation, its locations, or the network's function. This relates to Annex A 8.20 as secure management of networks and network devices includes reducing information leakage via wireless network identifiers that can aid reconnaissance. Annex A 8.20 is broader, covering the full range of network security controls, while ISM-1317 is a specific hardening requirement for wireless SSID naming.
This control is broader than ISM-1318.
ISM-1318 requires organisations to harden wireless access points by disabling SSID broadcasting to reduce wireless network discoverability. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes secure configuration of wireless access points. ISM-1318 is a specific technical configuration expectation within the broader network device security outcomes described by Annex A 8.20.
This control is broader than ISM-1319.
ISM-1319 requires organisations to avoid using static IP addressing for devices on wireless networks. Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information in systems and applications, which encompasses secure wireless network configuration practices such as DHCP-based addressing. ISM-1319 is a specific hardening requirement within the broader network security management expectations of Annex A 8.20.
This control is broader than ISM-1320.
ISM-1320 requires that MAC address filtering is not used to restrict which devices can connect to wireless networks, because it is not an effective access control. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which would include choosing robust wireless access control mechanisms rather than weak ones like MAC filtering. Annex A 8.20 is broader and technology-agnostic, while ISM-1320 is a specific prohibition focused on wireless access control design.
This control is broader than ISM-1321.
ISM-1321 addresses securing wireless network access by requiring 802.1X EAP-TLS mutual authentication with X.509 certificates and disabling other EAP methods. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information in systems and applications, which encompasses secure network access controls and authentication design. ISM-1321 is a specific network security configuration pattern within the wider scope of Annex A 8.20.
- ISM-1322Using evaluated supplicants, authenticators and authentication servers for 802.1XBroader than
This control is broader than ISM-1322.
ISM-1322 requires use of evaluated 802.1X ecosystem components to provide trustworthy authentication for wireless network access. This aligns with Annex A 8.20's requirement to secure, manage and control networks and network devices to protect information. ISM-1322 focuses specifically on WLAN access control via 802.1X and assurance of component evaluation, while Annex A 8.20 covers a much wider set of network security controls (e.g. configuration, management, and broader device security).
This control is broader than ISM-1323.
ISM-1323 requires certificate-based authentication (X.509) for 802.1X network access, strengthening assurance of endpoint and user identity at the point of network entry. This supports Annex A 8.20 by providing a concrete mechanism to secure and control access to networks and network devices, reducing the risk of unauthorised connection to switching and wireless infrastructure. Annex A 8.20 is broader and covers overall network/device security management beyond authentication (e.g. hardening, segmentation, secure administration).
This control is broader than ISM-1330.
Annex A 8.20 requires networks (including wireless) and network devices to be secured and controlled to protect information in connected systems and applications. ISM-1330 contributes by limiting PMK caching duration on wireless networks, reducing the window in which cached key material could be abused. Annex A 8.20 is broader because it covers all aspects of wireless and wired network security, not only a single WLAN key-management parameter.
This control is broader than ISM-1332.
ISM-1332 requires WPA3-Enterprise 192-bit mode to protect the confidentiality and integrity of all wireless network traffic. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes securing wireless LANs and their access points. ISM-1332 is a specific mandated technical implementation for one network use-case (wireless), while Annex A 8.20 is broader and technology-agnostic across all networks and devices.
This control is broader than ISM-1334.
Annex A 8.20 requires networks to be secured and controlled, which includes resilient and interference-aware wireless design where relevant. ISM-1334 relates by requiring sufficient frequency separation from other wireless networks, reducing interference and improving the reliability of wireless connectivity that systems and applications depend on. Annex A 8.20 is broader because it targets confidentiality, integrity and availability across all network technologies, while ISM-1334 is a specific WLAN engineering measure.
This control is broader than ISM-1335.
Annex A 8.20 requires secure management and control of networks and network devices to protect information from unauthorised access or interference. ISM-1335 maps to this by requiring 802.11w on wireless access points to protect management frames, mitigating deauthentication/disassociation attacks that can disrupt connectivity or aid interception. Annex A 8.20 is broader as it includes wider WLAN design and network device security requirements beyond management-frame protection.
This control is broader than ISM-1338.
ISM-1338 requires organisations to engineer Wi-Fi coverage using a greater number of lower-powered wireless access points rather than fewer high-powered ones, to constrain the wireless footprint. This relates to Annex A 8.20 because securing and controlling networks and network devices includes secure configuration and design choices for wireless infrastructure (e.g., access point placement and transmit power) to reduce exposure outside controlled areas. Annex A 8.20 is broader (covering all networks/devices and their management), while ISM-1338 is a specific wireless design technique within that broader expectation.
This control is broader than ISM-1364.
ISM-1364 addresses a specific network-device configuration requirement: VLANs for different security domains must terminate on separate physical interfaces. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed, and controlled to protect information, which includes secure configuration of switching, trunking, and interface design. ISM-1364 fits within Annex A 8.20 as a concrete control for reducing cross-domain exposure, but Annex A 8.20 also covers many other network-device security aspects beyond VLAN termination.
This control is broader than ISM-1386.
ISM-1386 requires that network management traffic can only originate from authorised administrative infrastructure. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes restricting who/what can administer network devices and from where. ISM-1386 is a specific technical restriction within the broader network security and management expectations of Annex A 8.20.
This control is broader than ISM-1416.
ISM-1416 requires software firewalls on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include host-based firewalling as a key technical measure. Annex A 8.20 is broader (covering network devices, monitoring and management), while ISM-1416 is a specific control mechanism focused on workstation/server software firewalls and application/service allow-listing for connections.
This control is broader than ISM-1427.
ISM-1427 requires gateways to perform ingress traffic filtering to detect and prevent IP source address spoofing. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which would commonly include configuring edge devices (e.g. routers/firewalls) with anti-spoofing controls such as ingress filtering (BCP38). Annex A 8.20 is broader in scope (covering overall network/device security), while ISM-1427 is a specific technical safeguard for a specific threat on gateways.
This control is broader than ISM-1428.
Annex A 8.20 requires secure management of networks and network devices to reduce opportunities for unauthorised access and data compromise. ISM-1428 supports this by requiring IPv6 tunnelling to be disabled unless explicitly required, reducing covert channels and bypass routes around security controls. Annex A 8.20 is broader as it covers end-to-end network security controls beyond the specific topic of IPv6 tunnelling.
This control is broader than ISM-1429.
ISM-1429 requires network security appliances at externally connected network boundaries to block IPv6 tunnelling. This is a specific network boundary control that contributes to securing and controlling networks as required by Annex A 8.20. Annex A 8.20 covers the security and management of all networks and network devices, while ISM-1429 addresses one tunnelling risk at the boundary.
This control is broader than ISM-1430.
ISM-1430 requires organisations to use DHCPv6 in a stateful mode to dynamically assign IPv6 addresses and store lease data in a centralised logging facility. This relates to Annex A 8.20, which covers centralized control of network configurations; however, Annex A 8.20 is broader, addressing overall network/device security management.
This control is broader than ISM-1439.
ISM-1439 focuses on protecting origin servers behind CDNs by preventing IP disclosure and enforcing network access restrictions to only the CDN and authorised management networks. ISO/IEC 27001 Annex A 8.20 covers securing and controlling networks and network devices generally, which includes firewalling, ACLs, routing controls, and exposure management needed to enforce origin-only-from-CDN connectivity. ISM-1439 is a specific pattern within the broader network security management expectations of Annex A 8.20.
This control is broader than ISM-1506.
Annex A 8.20 requires secure control and management of network services and device access methods to protect information. ISM-1506 maps to this by disabling SSH version 1, removing a weak legacy protocol from administrative access paths to network devices and servers. Annex A 8.20 is broader because it covers all network security mechanisms, while ISM-1506 addresses one specific protocol hardening requirement.
This control is broader than ISM-1521.
ISM-1521 requires CDSs to implement protocol breaks at each network layer to enforce strong separation of data flows between layers. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include using architectural patterns such as protocol breaks on gateways and boundary devices. Annex A 8.20 is broader and technology-agnostic, while ISM-1521 is a specific CDS design requirement focused on layered protocol separation.
This control is broader than ISM-1522.
ISM-1522 requires CDSs to enforce security independently on upward and downward transfer paths to prevent cross-domain leakage or backflow. ISO/IEC 27001:2022 Annex A 8.20 supports this by requiring networks and network devices to be secured, managed and controlled, which underpins the secure deployment and operation of a CDS and its directional controls. Annex A 8.20 does not explicitly require independent up/down enforcement functions, so it cannot be treated as equivalent to ISM-1522.
This control is broader than ISM-1532.
ISM-1532 requires organisations to avoid using VLANs as the separation mechanism between internal networks and public network infrastructure (e.g. the internet). ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which encompasses robust boundary design and controls for network separation. ISM-1532 is a specific prescriptive design constraint within the broader network security management expected by Annex A 8.20.
This control is broader than ISM-1553.
ISM-1553 requires TLS compression to be disabled for TLS connections to reduce protocol-level cryptographic risk. Annex A 8.20 mandates that networks and network devices be secured, managed, and controlled, typically encompassing hardening TLS configurations on network appliances. ISM-1553 outlines a specific, testable TLS hardening setting, whereas Annex A 8.20 covers a wider scope of network security governance.
This control is broader than ISM-1562.
ISM-1562 requires video conferencing and IP telephony infrastructure to be hardened to reduce exposure to compromise. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes securing VoIP/video conferencing network paths, edge devices, SBCs and supporting network services. ISM-1562 is a technology-specific application of the broader network and network-device security expectations in Annex A 8.20.
This control is broader than ISM-1628.
ISM-1628 requires organisations to block outbound network connections to anonymity networks (e.g. Tor or similar) to prevent covert or untraceable egress. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which commonly includes egress filtering and proxy/firewall policy enforcement that can implement such blocking. ISM-1628 is a specific, prescriptive instance of the broader network security management expectations in Annex A 8.20.
This control is broader than ISM-1710.
Annex A 8.20 sets the expectation that network devices are secured, managed and controlled to protect information handled by systems and applications. ISM-1710 directly aligns by requiring wireless access points to be hardened, which is a concrete network-device security activity. Annex A 8.20 is broader because it covers all network devices and network security practices, not only hardening of wireless access points.
This control is broader than ISM-1753.
ISM-1753 requires that internet-facing network devices that are no longer vendor-supported are replaced. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which would include lifecycle management practices such as keeping devices supported. ISM-1753 is a specific, prescriptive control within the broader network device security management expectations of Annex A 8.20.
This control is broader than ISM-1772.
Annex A 8.20 requires networks to be secured, including the protection of communications and inter-network connections. ISM-1772 supports this by mandating strong pseudorandom functions for IPsec connections, strengthening cryptographic protection for network tunnels and reducing risk of compromise of protected traffic. Annex A 8.20 is broader because it covers overall network/device security and management, while ISM-1772 is a specific IPsec cryptographic parameter requirement.
This control is broader than ISM-1774.
ISM-1774 requires gateways to be managed via a secure management path that is isolated from all connected networks. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information, which includes securely administering network devices such as gateways. ISM-1774 is a specific prescriptive administrative-network isolation requirement, whereas Annex A 8.20 is broader and can be satisfied through multiple complementary network/device security measures.
This control is broader than ISM-1781.
ISM-1781 requires all data communicated over network infrastructure to be encrypted to protect confidentiality and reduce interception risk. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which typically includes implementing encrypted protocols (e.g. TLS, IPsec, SSH) and secure network configurations. Annex A 8.20 is broader because it covers many network security measures beyond encryption, while ISM-1781 is specifically about encrypting network data in transit.
This control is broader than ISM-1782.
ISM-1782 requires implementing protective DNS to block resolution of known malicious domains, reducing exposure to malicious infrastructure. ISO/IEC 27001:2022 Annex A 8.20 requires securing and controlling networks and network devices, which commonly includes DNS security and network-level filtering controls. Protective DNS is a specific network security control that supports, but does not fully satisfy, the broader network governance and device security expectations in Annex A 8.20.
This control is broader than ISM-1783.
Annex A 8.20 requires networks to be secured and controlled, including the integrity of routing where it affects information delivery and availability. ISM-1783 relates by requiring valid ROA records for public IP addresses, strengthening BGP origin validation and reducing route hijacking risk. Annex A 8.20 is broader because it includes internal and external network security controls beyond public routing assurance mechanisms like RPKI.
This control is broader than ISM-1800.
ISM-1800 requires network devices to be flashed with trusted firmware before they are used for the first time, reducing the risk of compromised or unauthorised device code. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include ensuring devices run authentic, vendor-trusted firmware. ISM-1800 is a specific preventative measure within the broader network device security expectations of Annex A 8.20.
This control is broader than ISM-1801.
ISM-1801 requires network devices to be restarted at least monthly, a specific operational practice that helps clear volatile, memory-resident compromises and unsaved changes from network devices. It is one concrete way of meeting Annex A 8.20, which requires networks and network devices to be secured, managed and controlled. Annex A 8.20 covers network security management as a whole, whereas ISM-1801 addresses only the restart frequency of network devices.
This control is broader than ISM-1862.
ISM-1862 requires securing web hosting behind a WAF by avoiding disclosure of origin server IP addresses and restricting inbound connectivity to the origin to only the WAF and authorised management networks. ISO/IEC 27001:2022 Annex A 8.20 relates by requiring networks and network devices to be secured, managed and controlled, which includes implementing firewalling/routing controls, filtering, and management-plane restrictions that enforce the WAF-only path to the origin. Annex A 8.20 is broader and does not explicitly call out origin concealment or the specific WAF-fronted architecture required by ISM-1862.
This control is broader than ISM-1863.
ISM-1863 requires that networked management interfaces for IT equipment are not directly exposed to the internet. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which commonly includes protecting the management plane by restricting or blocking internet-reachable administration interfaces. Annex A 8.20 is broader and covers many other network security activities (e.g. segmentation, hardening, monitoring), whereas ISM-1863 is a single, explicit exposure prohibition.
This control is broader than ISM-1899.
ISM-1899 requires that non-administrative network devices cannot initiate connections to administrative infrastructure, enforcing strong separation of admin networks from other networks. Annex A 8.20 requires organisations to secure, manage and control networks and network devices to protect information systems and applications, which includes implementing controls such as ACLs, firewalls and routing restrictions. ISM-1899 is a specific network-connection restriction within the broader network security management expectations of Annex A 8.20.
This control is broader than ISM-1912.
ISM-1912 requires organisations to document device settings for critical and high-value servers, network devices and security appliances. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, enabled by reliable configuration documentation for baselining and change validation. ISM-1912 is documentation-centric, while Annex A 8.20 is operational security management of networks/devices.
This control is broader than ISM-1929.
ISM-1929 requires LDAP signing to be enabled on Microsoft AD DS domain controllers to protect directory authentication/integrity against tampering and downgrade-style attacks. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured and managed, which includes enforcing secure protocols and configurations on directory services carried over the network. ISM-1929 is a specific technical hardening requirement for one protocol/service, whereas Annex A 8.20 is broader across all networked services and devices.
This control is broader than ISM-1962.
Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information in systems and applications. ISM-1962 supports this by mandating that SMBv1 is not used on networks, reducing exposure to legacy protocol weaknesses and lateral movement paths. Annex A 8.20 is broader because it covers overall network security governance and technical controls beyond any single protocol configuration.
This control is broader than ISM-1963.
ISM-1963 requires security-relevant events for internet-facing network devices to be centrally logged. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, and central logging of device security events is a concrete mechanism that supports secure management and operational control. Annex A 8.20 is broader and covers many security measures beyond logging, whereas ISM-1963 is specifically about centralising security event logs for internet-facing devices.
This control is broader than ISM-1964.
ISM-1964 requires central logging of security-relevant events from non-internet-facing network devices. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled more generally. ISM-1964 is a specific network-device security measure (central logging) that sits within the broader expectations of Annex A 8.20.
This control is broader than ISM-1981.
ISM-1981 requires a specific action: replacing non-internet-facing network devices that are no longer vendor-supported. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled more broadly. ISM-1981 is a concrete lifecycle requirement that sits within the wider expectations of Annex A 8.20 for managing network device security.
This control is broader than ISM-2017.
ISM-2017 requires DNS traffic to be encrypted between clients and servers wherever supported to protect DNS queries and responses from interception and manipulation. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes implementing secure network services and protocols such as encrypted DNS (e.g. DoT/DoH) where appropriate. Annex A 8.20 is broader because it covers overall network/device security beyond DNS, while ISM-2017 is a specific requirement focused on DNS encryption.
This control is broader than ISM-2018.
Annex A 8.20 requires secure management and control of networks to protect information and maintain trusted connectivity. ISM-2018 supports this by requiring BGP routers to reject or deprioritise invalid RPKI-originated routes, reducing the likelihood of traffic misdirection, interception or outage. Annex A 8.20 is broader because it covers network security across all protocols, devices and segments, while ISM-2018 is specific to BGP routing validation behaviour.
This control is broader than ISM-2097.
ISM-2097 requires mobile devices to be configured with an always on VPN so device network traffic is protected in transit, especially on untrusted networks. This supports Annex A 8.20 by providing a concrete technical mechanism to secure and control network communications for a class of network endpoints (mobile devices). Annex A 8.20 is broader and covers overall network and network device security management beyond VPN enforcement on mobiles.
This control is broader than ISM-2130.
ISM-2130 addresses reducing network-exposed attack surfaces on AD CS by disabling web enrolment and, where necessary, enforcing secure transport (HTTPS) and protections against credential relay (Extended Protection for Authentication). Annex A 8.20 requires networks and network devices to be secured, managed, and controlled to protect information in systems and applications. ISM-2130 is a concrete, application-facing network service hardening action within the broader network security expectations of Annex A 8.20.
This control is broader than ISM-2150.
ISM-2150 requires gateways to block network connections for unauthorised remote monitoring and management (RMM) and remote access tools to prevent their use as back doors. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which commonly includes perimeter filtering, egress controls and blocking unwanted protocols/applications. ISM-2150 is a specific, concrete network security measure that sits within the broader network/device security outcomes of Annex A 8.20.
This control is broader than ISM-2161.
ISM-2161 requires verifying network device firmware integrity and running configuration against an approved known-good baseline after patching, on anomalous behaviour, and at least monthly. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes maintaining secure configurations and preventing unauthorised or unexpected changes. ISM-2161 is a specific integrity-checking activity within the broader network/device security control objective of Annex A 8.20.
This control is broader than ISM-2162.
ISM-2162 requires unneeded components, services and functionality on network devices to be disabled or removed to reduce attack surface. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes hardening actions such as disabling unnecessary services. Annex A 8.20 is broader (covering overall network/device security management), while ISM-2162 is a specific hardening requirement within that broader objective.
This control is broader than ISM-2163.
ISM-2163 requires that where MACsec is used, confidentiality mode is enabled using approved GCM-AES cipher suites (preferably 256-bit), ensuring link-layer traffic encryption. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information, which can include adopting link-layer encryption like MACsec on relevant segments. Annex A 8.20 is broader and technology-agnostic, while ISM-2163 is a specific prescriptive configuration requirement for MACsec.
This control is broader than ISM-2164.
ISM-2164 requires each MACsec link to use a connectivity association lifetime under 24 hours to enforce regular re-keying. ISO/IEC 27001:2022 Annex A 8.20 necessitates securing and managing networks and network devices, which can include configuring link-layer security parameters like MACsec key lifetimes. Annex A 8.20 is broader and technology-agnostic, whereas ISM-2164 is a specific configuration requirement for MACsec.
This control is broader than ISM-2166.
ISM-2166 requires configuring MACsec so each secure association (and its session keys) is replaced in under four hours to reduce exposure from long-lived link-layer keys. Annex A 8.20 requires networks and network devices to be secured, managed, and controlled, which can include securing Layer 2 links and enforcing cryptographic session/key lifetimes on network infrastructure. ISM-2166 is a very specific technical parameter for one network security mechanism, while Annex A 8.20 is broader and technology-agnostic.
This control is broader than ISM-2167.
ISM-2167 requires disabling PSK fallback for MACsec authentication to prevent downgrade to weaker authentication on Layer 2 links. Annex A 8.20 requires networks and network devices to be secured and controlled, which includes hardening link-layer security controls and authentication modes on switches, routers and NICs that support MACsec. Annex A 8.20 is higher-level and covers many network security outcomes beyond MACsec, whereas ISM-2167 is a precise requirement about one MACsec authentication setting.
This control partially overlaps ISM-1296.
ISM-1296 requires physical protections for network devices in public areas to prevent physical damage or unauthorised physical access. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information, typically focusing on technical and operational security (configuration, management, segmentation, monitoring). They overlap where physical tamper-resistance and prevention of unauthorised physical access are part of an overall network device security posture, but Annex A 8.20 extends well beyond physical security into technical controls that ISM-1296 does not address.
This control supports ISM-0518.
ISM-0518 requires organisations to develop, implement and maintain network documentation to support effective network management. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which is strengthened by accurate network diagrams, device inventories, data flows and interconnection records maintained under ISM-0518. The ISO control focuses on security outcomes and controls, while ISM-0518 focuses on the documentation artifacts that enable those outcomes.
This control supports ISM-1286.
ISM-1286 requires that files imported or exported via gateways or CDSs undergo content conversion to reduce the risk of unsafe or incompatible content crossing security boundaries. Annex A 8.20 requires networks and network devices (including boundary gateways) to be secured, managed and controlled, and content conversion is a concrete gateway control that strengthens that boundary protection. Annex A 8.20 is broader as it covers overall network/device security controls beyond file sanitisation/content transformation, while ISM-1286 is specifically about file handling through gateways/CDSs.
This control supports ISM-1982.
ISM-1982 requires replacement of unsupported networked IT equipment to avoid operating network infrastructure that can no longer be securely maintained by the vendor. This supports Annex A 8.20 because ensuring network devices remain vendor-supported underpins secure management and control of network and network devices. Annex A 8.20 is broader and includes configuration, administration, and control requirements that go beyond replacement decisions.
This control depends on ISM-0548.
ISM-0548 requires video conferencing and IP telephony calls to be established using a secure session initiation protocol to protect call signalling and session setup. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured and managed, which supports the ability to enforce and protect secure SIP configurations (e.g. allowing only secure signalling, restricting ports, and controlling gateway/proxy behaviour). Annex A 8.20 is broader network security governance, while ISM-0548 is a specific control focused on secure call/session initiation protocols.
This control depends on ISM-1809.
ISM-1809 requires compensating controls to reduce risk from unsupported network devices or equipment until they can be removed or replaced. Annex A 8.20 focuses on securing, managing and controlling networks and network devices, which provides common compensating measures (e.g. segmentation, restrictive ACLs, hardened management planes) to contain unsupported assets. Annex A 8.20 does not specifically address end-of-support scenarios or the requirement to retire/replace, but it strengthens the practical control options used to meet ISM-1809.
ASD Essentials for enterprise IT: 4 mappings
- IT.PRO-09.2Block outbound connections to known malicious and untrusted destinations using threat intelligenceBroader than
This control is broader than IT.PRO-09.2.
IT.PRO-09.2 requires outbound network connections to known malicious or untrusted destinations to be blocked. Egress filtering of this kind is a specific measure for controlling networks to protect information in systems and applications, contributing directly to Annex A 8.20. Annex A 8.20 is broader, covering the security, management and control of networks and network devices as a whole.
- IT.PRO-18.1Isolate systems in criticality- and trust-based network zones with approved, monitored pathwaysBroader than
This control is broader than IT.PRO-18.1.
IT.PRO-18.1 requires systems to be isolated within network zones by business criticality and trust level, with inbound and outbound access restricted and monitored to explicitly approved pathways and services. Zoning, traffic restriction and monitoring are specific measures for securing and controlling networks, so IT.PRO-18.1 directly contributes to Annex A 8.20. Annex A 8.20 is broader, also covering the security and management of networks and network devices themselves.
- IT.PRO-18.2Restrict lateral movement between and within segments to approved pathways and servicesBroader than
This control is broader than IT.PRO-18.2.
IT.PRO-18.2 requires lateral movement between and within network segments to be limited to explicitly approved pathways and services, based on business requirements and trust levels. Restricting internal traffic in this way is a specific measure for controlling networks to protect information in systems and applications, as Annex A 8.20 requires. Annex A 8.20 is broader, also covering the security and management of networks and network devices generally.
- IT.PRO-04.2Deploy approved configuration baselines to all infrastructure, operating systems and applicationsPartially overlaps
This control partially overlaps IT.PRO-04.2.
IT.PRO-04.2 requires approved configuration baselines to be deployed on systems, including infrastructure, operating systems and applications. Deploying approved baselines on network infrastructure helps secure network devices, which supports Annex A 8.20. Annex A 8.20 covers securing, managing and controlling networks more broadly, while IT.PRO-04.2 is limited to applying approved configurations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.