Key takeaways
- Define and monitor security for network services, internal or outsourced.
- Network services, including those from providers, need defined security features.
- Start here: identify network services you rely on.
Purpose
Define and monitor security for network services, internal or outsourced.
Requirement
Requirement summarySecurity mechanisms, service levels and service requirements of network services shall be identified, implemented and monitored.
Why it matters
Network services, including those from providers, need defined security features.
How to implement
- Identify network services you rely on.
- Define required security features and service levels.
- Include them in agreements with providers.
- Monitor service performance.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.21. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your security requirements for network services (internet, VPN, hosting connections).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.21 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Contracts or service descriptions from network providers showing security features.
- Monitoring records for network services.
- Records of service issues and how they were handled.
- A list of network services in use with owners.
Things you should be able to show or explain
- Be able to explain how network services are secured.
How much to show: Key network services.
Common mistakes
- No security requirements for network providers.
- Services not monitored.
- No security requirements for internet providers.
- Assuming default settings are secure.
- Tip: Include security SLAs with your ISP/network providers.
Policies & documents to have
- Operations Security Policy
- Third-Party Management Policy
FAQ
Is A.8.21 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.21?
Be ready to explain how the control works in your organisation and to provide things like: Your security requirements for network services (internet, VPN, hosting connections)…