ISO 27001 Annex A 8.21 Security of network services
What it says
Security mechanisms, service levels and service requirements of network services shall be identified, implemented and monitored.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure network services are secure, reliable, and meet agreed-upon standards.
This control is about making sure the network services your organisation uses are safe and reliable. If these services aren't protected, private data could be exposed, and services might become unavailable, causing disruptions and trust issues.
Free. Save your status, tasks and notes.
Why it matters
Without secure network services, sensitive data may be exposed or manipulated, leading to service outages and reputational damage.
How to implement
The IT Manager should identify all network services the organisation uses, whether they're provided internally or by an external vendor.
This means making a detailed list that includes the purpose and importance of each service.
The Procurement team, when engaging network service providers, should ensure contracts include specific security requirements.
This can be done by referencing guidelines from ISO 27002:2022 and Australian Privacy Act 1988 to ensure proper measures are included in agreements.
The IT Support Team should implement security tools like firewalls and encryption for network services.
For example, setting up encryption helps keep data safe when it's being sent across networks.
The IT Security Officer should regularly check if all network service providers are meeting agreed-upon security standards.
This involves setting up regular assessments and requesting security reports from providers.
The Board should approve a policy that governs who can access network services and under what conditions.
This includes setting up rules about using secure practices like VPNs (Virtual Private Networks) and monitoring access for compliance.
Keep it running
Define and review network service security mechanisms and SLAs; monitor availability, performance and security metrics with providers.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
Contracts or agreements with network service providers.
Look at
The specific security requirements included.
Good evidence
Should show clear commitments to security standards and audit rights agreed upon with providers.
- Check 2 of 4What an auditor asks for
Ask for
A list of network security tools in use, like firewalls or encryption protocols.
Look at
How these tools are configured and updated.
Good evidence
Setup will have clear documentation showing regular updates and threat assessments.
- Check 3 of 4What an auditor asks for
Look at
How these policies define role-based access controls and service usage.
Good evidence
Policy will align with ISO 27002 guidance and show consideration of Australian standards.
- Check 4 of 4What an auditor asks for
Ask for
Any third-party security attestations from network service providers.
Look at
The assessment details and how current they are. Good attestations should be recent and demonstrate the provider's compliance with robust security practices.
Mappings
Closest match in ASD Information Security Manual: ISM-0558, Restrict IP phone network access in public areas, which this control covers in full and more.
ASD Information Security Manual: 15 mappings
This control is broader than ISM-0558.
ISM-0558 mandates that IP phones in public areas are prevented from accessing data networks and sensitive telephony services such as voicemail and directories. Annex A 8.21 focuses on defining, implementing, and monitoring security mechanisms and requirements for network services, which can include ensuring voice services are delivered without exposing broader internal services to public-area endpoints. ISM-0558 is an explicit access restriction for a specific endpoint class, whereas Annex A 8.21 is broader and service-governance oriented.
This control is broader than ISM-1186.
ISM-1186 requires IPv6 capable network security appliances to be used on IPv6 and dual-stack networks to maintain protective security controls. Annex A 8.21 requires the organisation to identify, implement, and monitor security mechanisms and service requirements for network services, which would include specifying IPv6 support where IPv6 network services are used. ISM-1186 is a concrete implementation detail that helps satisfy the broader requirement to define and assure secure network services in Annex A 8.21.
This control is broader than ISM-1314.
ISM-1314 requires that all wireless devices are Wi‑Fi Alliance certified, effectively setting a minimum standard for wireless device capability and conformance. This relates to Annex A 8.21 (Security of Network Services) where network service security mechanisms and requirements must be identified and implemented; using certified devices can help ensure the service can meet expected Wi‑Fi security mechanisms (e.g. standards-based authentication/encryption support). Annex A 8.21 is broader because it focuses on defining, delivering and monitoring network service security and service levels, not on device certification as an entry criterion.
This control is broader than ISM-1323.
ISM-1323 requires X.509 certificates for 802.1X authentication, ensuring only authenticated devices and users can access network services delivered over 802.1X-controlled ports/SSIDs. This supports Annex A 8.21 by implementing an access-enforcement mechanism that is commonly part of securing network services (e.g. enterprise Wi‑Fi, wired access). Annex A 8.21 has wider scope including defining and monitoring security mechanisms and service requirements, not just identity assurance for access.
This control is broader than ISM-1335.
ISM-1335 mandates enabling 802.11w to protect wireless management frames against manipulation. Annex A 8.21 requires the identification, implementation, and monitoring of appropriate security mechanisms for network services, including secure WLAN service configurations. ISM-1335 is a specific WLAN security mechanism, while Annex A 8.21 covers a wider set of network services, and associated service levels and monitoring.
This control is broader than ISM-1628.
ISM-1628 requires organisations to block outbound connections to anonymity networks to reduce exfiltration and command-and-control concealment. ISO/IEC 27001:2022 Annex A 8.21 focuses on identifying, implementing and monitoring security mechanisms and requirements for network services, which can include controlling which external services/protocols are permitted and monitoring for prohibited services such as anonymisers. ISM-1628 is a specific egress-control requirement, whereas Annex A 8.21 is broader and covers service-level security and monitoring beyond anonymity networks.
This control is broader than ISM-1962.
ISM-1962 requires SMB version 1 to not be used on networks, reducing exposure to known weaknesses in legacy file-sharing services. Annex A 8.21 requires security mechanisms and requirements for network services to be identified, implemented and monitored, which would typically drive decisions to disable or deprecate insecure services/protocol versions like SMBv1. Annex A 8.21 covers all network services and governance/monitoring expectations, whereas ISM-1962 is limited to eliminating SMBv1 specifically.
This control partially overlaps ISM-1182.
Annex A 8.21 requires organisations to implement and monitor security mechanisms for network services and ensure they meet defined requirements. ISM-1182 relates by requiring network access controls that limit traffic flows within and between segments to business-required communications, which is a core network service security mechanism. ISM-1182 is more prescriptive about internal traffic flow control, while Annex A 8.21 additionally covers service level definition/assurance and security requirements for specific network services (e.g. DNS, remote access, managed links).
This control partially overlaps ISM-1479.
ISM-1479 requires servers to minimise communications with other servers at the network and file system level. Annex A 8.21 requires security mechanisms and requirements for network services to be identified, implemented and monitored, which can include restricting which server-to-server services (e.g. RPC, SMB, database ports) are permitted. Annex A 8.21 is broader because it addresses all network service security and service levels, whereas ISM-1479 is specifically about reducing the extent of inter-server communications rather than securing the services that remain.
This control partially overlaps ISM-1577.
Annex A 8.21 requires an organisation to identify, implement and monitor security mechanisms and service requirements for network services. ISM-1577 relates by mandating segregation between an organisation's networks and service providers' networks, which is a concrete security mechanism for certain network services (e.g. outsourced connectivity, managed network services). ISM-1577 is narrower (focused on provider segregation) while Annex A 8.21 also covers broader network service requirements such as agreed service levels, monitoring and end-to-end security expectations across all network services.
This control partially overlaps ISM-1579.
Annex A 8.21 focuses on defining and meeting security mechanisms and service levels for network services, including reliability and performance expectations. ISM-1579 relates by requiring verification of a cloud service provider's ability to dynamically scale during demand spikes as part of capacity and availability planning, which is an input to meeting agreed service levels. ISM-1579 is specific to cloud scalability and availability planning, while Annex A 8.21 is broader and includes security controls and ongoing monitoring across all network services, not just cloud capacity planning.
This control partially overlaps ISM-1581.
Annex A 8.21 requires security mechanisms, service levels and service requirements for network services to be identified, implemented and monitored. ISM-1581 directly aligns with the monitoring aspect by requiring continuous real-time monitoring of capacity and availability of online services, which are common service-level attributes for network services. ISM-1581 is narrower (capacity/availability monitoring for online services), whereas Annex A 8.21 additionally addresses defining requirements and implementing security mechanisms beyond availability (e.g. protections, authentication, resilience).
This control partially overlaps ISM-1738.
Annex A 8.21 requires that security requirements for network services are identified and that implemented mechanisms and service levels are monitored. ISM-1738 supports this by ensuring the organisation regularly exercises its right to verify service provider compliance with contracted security requirements, which is a governance mechanism to assure third-party network services meet agreed requirements. ISM-1738 focuses on supplier assurance and contractual compliance, whereas Annex A 8.21 is broader and includes technical implementation and operational monitoring of the network services themselves.
This control supports ISM-2068.
ISM-2068 requires organisations to strictly limit internet connectivity to only those networked devices that require access. Annex A 8.21 supports this by requiring security mechanisms and service requirements for network services to be identified, implemented and monitored, which can include enforcing and monitoring internet egress controls.
This control depends on ISM-1037.
Annex A 8.21 requires security mechanisms for network services to be implemented and monitored. ISM-1037 supports this by requiring gateways to be tested after changes and at least every six months to validate expected security configurations, which is a form of assurance/monitoring over a critical network service component. ISM-1037 is gateway-specific and focuses on configuration validation cadence, while Annex A 8.21 covers broader network services, including defining service levels and requirements beyond configuration compliance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.