ISO 27001 Annex A 8.22 Network segregation for security
What it says
Groups of information services, users and information systems shall be segregated in the organization's networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSeparate network groups to limit risks and control access between services, users, and systems.
Network segregation for security means dividing up a company's network into smaller, isolated parts to keep different activities and data separate. This is important because it limits what can go wrong if one part of the network is breached, ensuring that problems like cyber attacks don't spread throughout the entire organisation.
Free. Save your status, tasks and notes.
Why it matters
Without network segregation, attackers can move laterally between services and systems, escalating access and exposing sensitive data.
How to implement
The IT manager should identify different groups or departments within the organisation that need separate network segments.
They can do this by assessing the kinds of data used and the level of access different employees need, ensuring that sensitive information is kept on more secure, isolated sections.
The IT team should configure network devices like firewalls to establish clear boundaries between these network segments.
They can do so by setting rules that control the flow of information, allowing only necessary connections between the parts of the network while keeping other traffic out.
The security team should implement access control policies to ensure only authorised personnel can access parts of the network relevant to their work.
This could involve using password protections and user authentication systems aligned with Australia's Privacy Act 1988.
The procurement team should ensure that any new network equipment purchased supports network segmentation.
This might include routers and switches that facilitate virtual local area networks (VLANs), which help to logically separate network traffic.
The IT manager should regularly review and update network segmentation practices to accommodate organisational changes and evolving security threats.
They should use guidance from the ISO 27002:2022 and align with local regulations like OAIC requirements.
The IT support staff should conduct regular training for employees about the importance of network segregation.
They can explain how it protects information security and why certain access restrictions are in place.
Keep it running
Review segmentation rules as services change; validate firewalls/ACLs restrict traffic between segments to only approved flows.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request a network diagram showing segmented domains.
Look at
Check if the diagram clearly separates different sections of the network with labelled boundaries.
- Check 2 of 5What an auditor asks for
Ask for
Request the network access control policy.
Look at
Review if the policy defines how access is granted or restricted between different network segments.
- Check 3 of 5What an auditor asks for
Ask for
Ask for records of firewall configurations and rules.
Look at
Verify that the configurations show rules controlling data flow between network segments.
- Check 4 of 5What an auditor asks for
Ask for
Request logs or audit trails for access attempts to network segments.
Look at
Examine if there are logs showing who accessed what parts of the network and when.
- Check 5 of 5What an auditor asks for
Ask for
Request evidence of employee training and awareness programs on network security.
Look at
Check for records of training sessions and materials covering network segregation.
Mappings
Closest match in ASD Information Security Manual: ISM-1181, Segregate networks by server criticality, which asks for the same thing.
ASD Information Security Manual: 46 mappings
This control is equivalent to ISM-1181.
ISM-1181 requires networks to be segregated into multiple zones based on the criticality of servers, services and data. ISO/IEC 27001:2022 Annex A 8.22 similarly requires segregation of groups of information services, users and information systems within organisational networks. ISM-1181 is more explicit about using criticality to drive zoning, but both controls are fundamentally met through implementing network segmentation and zone separation.
This control is broader than ISM-0213.
ISM-0213 requires SECRET and TOP SECRET network cables to be terminated on separate, dedicated patch panels to enforce physical segregation by classification. ISO/IEC 27001:2022 Annex A 8.22 calls for the segregation of services, users, and systems within networks, which can encompass such physical cabling segregation as one implementation approach. Annex A 8.22 is broader, while ISM-0213 is a specific, classified-environment cabling requirement.
This control is broader than ISM-0529.
ISM-0529 requires that VLANs are not used to separate network traffic between networks belonging to different security domains. Annex A 8.22 requires organisations to segregate groups of information services, users and systems within networks, which can include multiple technical methods for segmentation. ISM-0529 is a specific constraint on an unsafe segmentation approach (VLANs across security domains), whereas Annex A 8.22 is broader and technology-agnostic about how segregation is achieved.
This control is broader than ISM-0535.
ISM-0535 requires organisations to prevent VLAN trunks from being shared between VLANs belonging to different security domains, to maintain separation of security areas over the network. This maps to ISO/IEC 27001:2022 Annex A 8.22 because VLAN trunk isolation is a concrete network segregation mechanism used to segregate groups of services, users and systems. Annex A 8.22 is broader (covering segregation by many methods such as routing/ACLs, firewalls, VRFs, physical separation), while ISM-0535 is a specific prohibition focused on trunk sharing across domains.
This control is broader than ISM-0536.
ISM-0536 requires that public wireless networks provided for general public use are segregated from all other organisation networks. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation between groups of users, services and systems, which directly includes separating an untrusted public Wi‑Fi segment from internal corporate networks. Annex A 8.22 is broader because it applies to segregation needs across the whole environment (not only public Wi‑Fi), while ISM-0536 is a specific segregation use case.
This control is broader than ISM-0549.
ISM-0549 requires video conferencing and IP telephony traffic to be separated physically or logically from other data traffic. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation between groups of services, users and systems, which can be implemented using VLANs/VRFs/ACLs, and includes segregating voice/video as a specific use case. ISM-0549 is therefore a specific application of the broader segregation requirement in Annex A 8.22, focused explicitly on real-time communications traffic.
This control is broader than ISM-0556.
ISM-0556 requires organisations to keep video conferencing and IP telephony traffic separated from other workstation/data traffic using VLANs or similar mechanisms. This relates directly to Annex A 8.22, which requires network segregation between groups of services, users and systems as a general security practice. ISM-0556 is a specific, technology-focused instance of the broader network segregation requirement in Annex A 8.22.
This control is broader than ISM-0558.
ISM-0558 requires that IP phones located in public areas are technically restricted so they cannot access data networks, voicemail, or directory services. Annex A 8.22 requires network segregation between groups of services/users/systems, which is a common method to place public-area IP phones on a constrained voice-only segment or VLAN. ISM-0558 is a specific use case and outcome, whereas Annex A 8.22 is a broader network design control that applies across the organisation.
This control is broader than ISM-0626.
ISM-0626 requires organisations to implement Cross Domain Solutions (CDSs) between SECRET or TOP SECRET networks and any other networks in different security domains. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation of groups of services, users, and systems. This broader design objective encompasses the type of segmentation enforced by CDSs for high-side networks. ISM-0626 is more specific due to its focus on higher classifications (SECRET/TOP SECRET) and cross-domain connections, whereas Annex A 8.22 applies more generally to various network environments.
This control is broader than ISM-0628.
ISM-0628 requires gateways to be implemented between networks belonging to different security domains to control and mediate inter-domain connectivity. ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of services, users and systems within organisational networks, which is commonly implemented using network boundaries and controlled interconnections (including gateways). Annex A 8.22 is broader because it covers internal segregation objectives generally, while ISM-0628 focuses specifically on the gateway control point between distinct security domains.
This control is broader than ISM-0635.
ISM-0635 requires CDSs to implement isolated upward and downward network paths to separate data flows by direction and reduce the risk of cross-domain compromise. This relates to Annex A 8.22, which requires network segregation between groups of services, users and systems to enforce security boundaries within organisational networks. ISM-0635 is a specific, high-assurance segregation pattern for cross-domain solutions (directional path isolation), whereas Annex A 8.22 is broader and does not specifically mandate separate uplink/downlink paths.
This control is broader than ISM-0637.
ISM-0637 requires gateways to implement a demilitarised zone (DMZ) when external parties need access to an organisation's services. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation between groups of services, users and systems, which commonly includes using a DMZ as a segregation pattern for internet/external access. Annex A 8.22 is broader because it applies to all network segmentation needs, not specifically the gateway DMZ requirement for external-party access described in ISM-0637.
This control is broader than ISM-0639.
ISM-0639 requires the use of evaluated (high assurance) firewalls/diode gateway solutions when interconnecting networks in different security domains. ISO/IEC 27001:2022 Annex A 8.22 relates by requiring network segregation, which is typically implemented using boundary controls such as firewalls and gateways between network zones. Annex A 8.22 sets the architectural need for segregation, while ISM-0639 adds the assurance requirement that the boundary device be formally evaluated for high-security cross-domain use.
This control is broader than ISM-0643.
ISM-0643 requires evaluated diodes to enforce one-way data flow at a unidirectional gateway between organisational networks and public network infrastructure. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation of services, users and systems, and a unidirectional gateway implemented with a diode is a strong segregation mechanism to prevent reverse-path data movement. Annex A 8.22 is about segmentation design broadly, whereas ISM-0643 focuses specifically on assuring unidirectionality rather than general segregation across the enterprise network.
This control is broader than ISM-0645.
ISM-0645 requires high assurance evaluation of evaluated diodes used in unidirectional gateways at SECRET/TOP SECRET to public network boundaries to provide strong one-way separation. Annex A 8.22 requires network segregation of information services, users and systems, and at highly sensitive boundaries one-way gateways are one possible (though not required) segregation mechanism. ISM-0645 is narrower because it specifies a particular cross-domain segregation implementation and an assurance level for the diode, whereas Annex A 8.22 remains technology-agnostic and broader in scope.
This control is broader than ISM-0874.
ISM-0874 requires endpoints to access the internet through a VPN to the organisation's internet gateway, centralising egress and inspection points. Annex A 8.22 focuses on segregating users and services within networks to reduce risk and limit lateral movement. Routing endpoint internet traffic back through the organisation can support implementing and enforcing segregation policies (e.g. separating user subnets from internet egress zones), but segregation can be implemented without mandating VPN-for-internet for all endpoints.
This control is broader than ISM-1157.
ISM-1157 requires evaluated diodes to control data flow in unidirectional gateways between networks. Such gateways enforce a controlled, one-way boundary between separate networks, which supports and strengthens the network segregation required by Annex A 8.22. Annex A 8.22 requires segregation of groups of services, users and systems generally, while ISM-1157 is limited to the assurance of the flow control device at one type of gateway.
This control is broader than ISM-1158.
ISM-1158 requires high assurance evaluated network diodes for unidirectional gateways separating SECRET/TOP SECRET networks from other networks. Annex A 8.22 requires segregation of groups of information services, users and systems within organisational networks, and unidirectional gateways are one concrete mechanism used to achieve strong segregation where one-way flows are required. The candidate control does not require diodes or evaluation, but ISM-1158 strengthens the segregation outcome by mandating assurance of the component that enforces the separation.
This control is broader than ISM-1270.
ISM-1270 requires database servers to be placed on a different network segment to user workstations to reduce exposure and limit lateral movement. This directly relates to Annex A 8.22, which requires organisations to segregate groups of information services, users and information systems within networks. ISM-1270 is a specific, prescriptive instance of network segregation focused on databases versus user endpoints, whereas Annex A 8.22 is broader and can apply to many other segmentation patterns.
This control is broader than ISM-1364.
ISM-1364 requires VLANs from different security domains to be terminated on separate physical network interfaces to prevent cross-domain traffic mixing. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation of services, users, and systems, which commonly includes segmentation using VLANs, routing/firewall boundaries, and physical separation. ISM-1364 is a specific technical implementation pattern for segregation (physical interface separation for VLAN termination), whereas Annex A 8.22 is broader and technology-agnostic about how segregation is achieved.
This control is broader than ISM-1436.
ISM-1436 requires critical online services to be segregated from other online services that are more likely to be targeted by denial-of-service (DoS) attacks, reducing the likelihood that an attack on one service disrupts another. Annex A 8.22 requires network segregation of groups of information services, users, and information systems, providing the general mechanism (segmented network zones) that can be applied to isolate critical services from higher-risk/public-facing services. ISM-1436 is a specific, DoS-driven instance of the broader network segregation requirement in Annex A 8.22.
This control is broader than ISM-1439.
ISM-1439 requires organisations using CDNs to avoid disclosing origin server IP addresses and to restrict origin access to the CDN and authorised management networks. ISO/IEC 27001 Annex A 8.22 relates by requiring network segregation, which is commonly implemented by isolating origin servers into dedicated segments reachable only from CDN egress and tightly controlled management subnets. ISM-1439 is a specific CDN/origin hardening use case, while Annex A 8.22 is broader network zoning across all services.
This control is broader than ISM-1528.
ISM-1528 requires evaluated firewalls to be deployed between an organisation's networks and public network infrastructure to control and filter traffic at the internet boundary. Annex A 8.22 requires segregation of groups of services, users and systems within organisational networks, and perimeter firewalls are a common mechanism to enforce boundary separation between network zones (e.g. internal, DMZ, external). Annex A 8.22 is broader in that it covers internal network segmentation generally (not just the internet edge), while ISM-1528 is specifically about evaluated firewalls at the public interface.
This control is broader than ISM-1532.
ISM-1532 requires that VLANs are not used to separate traffic between an organisation's networks and public network infrastructure. ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of information services, users and information systems within organisational networks, which includes (but is not limited to) the approach used at the internet boundary. ISM-1532 is a specific prohibition about one segregation method in a particular context, while Annex A 8.22 is a broader requirement to implement network segregation generally.
This control is broader than ISM-1899.
ISM-1899 requires that devices outside administrative infrastructure are prevented from initiating connections into administrative infrastructure. Annex A 8.22 requires segregation of groups of information services, users and information systems within organisational networks, typically via segmentation, zoning and traffic filtering. ISM-1899 is a concrete segregation outcome focused on administrative infrastructure connectivity, while Annex A 8.22 is broader and covers segregation across many business/system groupings.
This control is broader than ISM-1970.
ISM-1970 specifies analysis of malicious code in a segregated environment to safeguard other systems. This is related to ISO/IEC 27001:2022 Annex A 8.22, which advocates for network segregation to limit the impact of events. Annex A 8.22 is broader, while ISM-1970 pertains specifically to dedicated environments for malware analysis.
This control is broader than ISM-2160.
ISM-2160 requires networked management interfaces for IT equipment to be reachable only from a dedicated management network that is segregated from the wider network and the internet. ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of services, users and systems within organisational networks, which directly includes segregating management-plane access from user/data networks. ISM-2160 is a specific, prescriptive application of network segregation focused on management interfaces and a dedicated management network, whereas Annex A 8.22 is broader and less implementation-specific.
This control partially overlaps ISM-0385.
ISM-0385 requires servers to be functionally separated so each server can operate independently without interference from others. Annex A 8.22 mandates network segregation of groups of services, users and systems, which is a primary technical mechanism used to achieve and enforce that server separation. ISM-0385 focuses on the outcome (independent operation), while Annex A 8.22 focuses on network design controls to help deliver that outcome.
This control partially overlaps ISM-1182.
Annex A 8.22 requires segregating groups of information services, users, and information systems within organisation networks to limit risk and control interconnection. ISM-1182 complements this by requiring network access controls that restrict traffic flows within and between segments, focusing on governing permitted traffic paths.
This control partially overlaps ISM-1269.
Annex A 8.22 requires segregating groups of information services and systems within networks to limit lateral movement and unauthorised access between them. ISM-1269 relates by requiring functional separation between database servers and web servers, which is a common tier-segmentation objective that is typically enforced via network zoning/segmentation. ISM-1269 is more application-architecture specific, whereas Annex A 8.22 covers segregation for any service/user/system grouping, not only web/database tiers.
This control partially overlaps ISM-1271.
ISM-1271 requires organisations to restrict database server communications to only the network resources that require access. Annex A 8.22 requires segregation of groups of information services, users and information systems within networks, commonly implemented via VLANs, zones, and firewall rules that can limit which segments can reach a database. Annex A 8.22 is broader (segregation across the network), while ISM-1271 is narrower but may also require controls beyond segmentation (e.g. explicit allow-lists for DB ports and source systems).
This control partially overlaps ISM-1385.
Annex A 8.22 requires segregating groups of systems, services and users within organisational networks to limit compromise spread and constrain access paths. ISM-1385 relates by mandating segregation of administrative infrastructure from the wider network and the internet, which is a key instance of segregating a high-trust management network from lower-trust zones. ISM-1385 is narrower (admin infrastructure specific) while Annex A 8.22 is broader and applies to any network grouping.
This control partially overlaps ISM-1386.
ISM-1386 requires that network management traffic can only originate from administrative infrastructure. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation, which commonly includes separating management networks from user networks and constraining management-plane access to specific segments. ISM-1386 is more specific about the allowed origin of management traffic, whereas Annex A 8.22 is broader and covers segregation across many service/user/system groupings beyond management traffic.
This control partially overlaps ISM-1479.
ISM-1479 requires servers to minimise communications with other servers at both the network layer and file system level to reduce lateral movement and unnecessary trust paths. Annex A 8.22 requires network segregation of services, users and systems, which is a common way to technically enforce reduced server-to-server reachability. Annex A 8.22 is broader (segregation across the whole organisation's network) and does not specifically address file system-level server-to-server interactions, while ISM-1479 focuses specifically on reducing inter-server communication paths.
This control partially overlaps ISM-1577.
Annex A 8.22 requires segregation of groups of services, users, and systems within organisational networks. ISM-1577 directly relates by mandating segregation between an organisation's networks and service providers' networks, focusing on external boundary segmentation.
This control partially overlaps ISM-1750.
Annex A 8.22 requires groups of services, users and systems to be segregated in organisational networks to reduce risk and control access between groups. ISM-1750 relates by mandating segregation of administrative infrastructure for critical, high-value and regular servers, which is a concrete network/domain segmentation pattern. ISM-1750 is narrower and focused on admin infrastructure separation by server criticality, while Annex A 8.22 is broader across all network groupings and use cases.
This control partially overlaps ISM-1774.
ISM-1774 requires gateways to be managed over a secure path isolated from networks the gateway connects to (i.e., separation of the management plane from data/connected networks). ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of information services, users and systems within organisational networks, which can include segregating a dedicated management network/VLAN. Annex A 8.22 is broader network segmentation, while ISM-1774 is specifically about secure, isolated management access to gateways.
This control partially overlaps ISM-1862.
Annex A 8.22 requires segregating network groups to control access between services and systems. ISM-1862 relates by implementing a boundary around web servers through the WAF, creating a segmentation instance specific to web application architecture.
This control supports ISM-0530.
ISM-0530 requires VLAN management interfaces and activities to be administered from the most trusted security domain. This supports Annex A 8.22 by reinforcing effective network segregation, because restricting where VLAN administration can occur reduces the chance that less-trusted segments can alter segmentation boundaries. Annex A 8.22 focuses on designing and implementing segregation itself, while ISM-0530 focuses on the administrative control plane used to manage that segregation.
This control supports ISM-0629.
ISM-0629 addresses governance of gateways that connect different security domains by mandating trusted administration of shared gateway components. Annex A 8.22 requires network segregation, which commonly creates and relies on controlled gateways between segregated zones or domains. Annex A 8.22 focuses on segmentation design, whereas ISM-0629 focuses on administrative ownership/trust for the shared gateway components that enforce that segregation.
This control supports ISM-1521.
ISM-1521 requires CDSs to implement protocol breaks at each network layer to prevent direct end-to-end protocol continuity and reduce cross-layer or cross-domain attack paths. ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of services, users and systems in organisational networks, typically via zoning, VLANs, firewalls and routing controls. Protocol breaks can strengthen segregation by ensuring transitions between zones/layers are mediated and re-terminated, but Annex A 8.22 does not require protocol breaks specifically.
This control supports ISM-1522.
ISM-1522 requires CDSs to implement independent security-enforcing functions for both upward and downward data paths across network boundaries. ISO/IEC 27001:2022 Annex A 8.22 supports this by requiring network segregation, which is a foundational architectural measure that reduces unintended bidirectional flows and helps define where a CDS must enforce separate paths. However, Annex A 8.22 is broader and more general about segmentation, while ISM-1522 is a specific CDS design requirement for independent enforcement per direction.
This control supports ISM-2068.
ISM-2068 requires organisations to strictly limit internet connectivity to only those networked devices that require access. Annex A 8.22 supports this by requiring segregation of groups of information services, users and systems, which enables isolating non-internet-requiring devices onto networks without outbound internet paths. The ISO control provides broader network architecture guidance, while ISM-2068 is focused on restricting internet access.
This control depends on ISM-0631.
ISM-0631 requires gateways to enforce explicitly authorised data flows and block all unauthorised transfers. Annex A 8.22 relates by requiring network segregation, which reduces and structures the pathways that gateways must control and makes it practical to define and enforce authorised flows between segments. Annex A 8.22 focuses on segmentation design, whereas ISM-0631 focuses on enforcement at gateways for the flows that traverse boundaries.
This control depends on ISM-1457.
ISM-1457 requires evaluated peripheral switches shared between SECRET and TOP SECRET systems, or between such systems in different security domains, to preferably complete a high assurance evaluation. A shared peripheral switch could otherwise bridge systems that are meant to be kept apart, so a high assurance switch helps preserve the segregation required by Annex A 8.22. Annex A 8.22 concerns segregating groups of services, users and systems within networks, whereas ISM-1457 addresses the assurance of a device that connects separately segregated systems.
This control depends on ISM-2152.
ISM-2152 requires backup infrastructure to be segregated from production and to use a separate authentication mechanism for administrative access. This supports ISO/IEC 27001:2022 Annex A 8.22 by being a concrete application of network/service segregation for a high-value environment (backup systems) to reduce lateral movement and privilege abuse. Annex A 8.22 is broader (segregation across groups of services/users/systems generally), while ISM-2152 is specific to backup infrastructure and admin authentication separation.
ASD Essentials for enterprise IT: 4 mappings
- IT.PRO-10.2Isolate backup repositories from general user environments and production workloadsBroader than
This control is broader than IT.PRO-10.2.
IT.PRO-10.2 requires backup repositories to be isolated from general user environments, production workloads and primary systems to prevent unauthorised access, modification or deletion. Network segregation under Annex A 8.22 is a principal way to achieve this, making IT.PRO-10.2 a specific application of segregating a sensitive group of systems from users and other systems. Annex A 8.22 covers segregation of all groups of information services, users and information systems, while IT.PRO-10.2 addresses only backup repositories.
- IT.PRO-18.1Isolate systems in criticality- and trust-based network zones with approved, monitored pathwaysPartially meets
This control partially meets IT.PRO-18.1.
IT.PRO-18.1 requires systems to be isolated within network zones based on business criticality and trust level, with inbound and outbound access restricted to explicitly approved pathways and services and monitored. Its zoning requirement directly delivers the segregation of groups of information services, users and information systems required by Annex A 8.22. IT.PRO-18.1 is broader, as it also requires traffic into and out of each zone to be limited to approved pathways and monitored, which Annex A 8.22 does not state.
- IT.PRO-05.1Restrict administration to dedicated, hardened environments isolated from unprivileged user workloadsPartially overlaps
This control partially overlaps IT.PRO-05.1.
IT.PRO-05.1 requires administrative activities to be performed only from dedicated, hardened environments that are isolated from unprivileged user workloads. Separating administrative users and systems from general user workloads shares common ground with Annex A 8.22, which requires groups of users and information systems to be segregated in the organisation's networks. IT.PRO-05.1 also requires the administrative environment to be hardened, while Annex A 8.22 covers network segregation for all groups of services, users and systems.
- IT.PRO-18.2Restrict lateral movement between and within segments to approved pathways and servicesPartially overlaps
This control partially overlaps IT.PRO-18.2.
IT.PRO-18.2 requires lateral movement between and within network segments to be limited to explicitly approved pathways and services, based on business requirements and trust levels. It shares common ground with Annex A 8.22, as restricting traffic between segments is what makes the segregation of groups of services, users and systems effective. Annex A 8.22 requires the segregation itself, while IT.PRO-18.2 also restricts movement within segments, which goes beyond segregating groups.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.