ISO 27001 A.8.21: Security of Network Services

Quick Reference (60 Seconds)

The Bottom Line: A.8.20 secures your network. A.8.21 is about the services your network depends on (internet connectivity, private links, DNS, CDN, DDoS protection, managed security) and the providers that run them: what security you require, whether it is in the contract, how you check it, and the rules for using those services.

What the Control Asks For

In short

Annex A 8.21 asks organizations to identify, implement and monitor the security mechanisms, service levels and service requirements of network services.

Do you need this control?

A.8.21 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Almost every organisation relies on network services from providers, so it is usually included.

What ISO 27002:2022 Adds

ISO 27002 8.21 (paraphrased):

• Identify the security measures each network service needs (security features, service levels and service requirements) and implement them, whether the service is provided internally or by an external provider. Make sure providers implement these measures.
• Determine and regularly monitor the provider's ability to manage the agreed services securely.
• Agree a right to audit with the provider, and consider third-party attestations (for example ISO 27001 certificates or SOC 2 reports) as evidence.

Rules on the use of networks and network services should cover:

• (a) which networks and services may be accessed
• (b) authentication requirements for each service
• (c) authorisation procedures for who may access which networks and services
• (d) network management and technical controls protecting access to connections and services
• (e) the means of access (for example VPN or wireless)
• (f) time, location and other user attributes at the time of access
• (g) monitoring use of network services

Security features to consider:

• (a) technology for securing services: authentication, encryption, network connection controls
• (b) technical parameters for secure connection, in line with your security and connection rules
• (c) caching (for example in a CDN) and its parameters, balancing performance and availability against confidentiality
• (d) procedures to restrict access to services or applications where needed

27002 notes that network services range from simple bandwidth to private networks and managed security services such as firewalls and intrusion detection.

What Belongs to Neighbouring Controls

Why It Matters

Your Network Depends on Other People's Networks

Most organisations rely on an ISP or two, a private WAN or SD-WAN provider, public or managed DNS, a CDN, DDoS protection, and often a managed firewall or SOC. If any of these is insecure or fails, you are exposed, and you cannot see inside them. The protection comes from what you require, what the contract says, and how you check it.

Typical problems:

• An ISP or SD-WAN contract with an availability SLA but nothing about security incidents, notification or log access
• A managed firewall provider with standing administrative access and no reporting
• DNS or CDN settings left at defaults (for example caching pages that contain personal data)
• No rule on which networks staff may use for work (open public Wi-Fi without a VPN or ZTNA)

Regulatory and Contractual Drivers

• RBI: the Master Direction on Outsourcing of IT Services (2023) requires due diligence, contractual security terms, audit rights and monitoring of IT service providers, including network and managed security services
• SEBI CSCRF (2024) and IRDAI (2023) set third-party and outsourcing security expectations for regulated entities
• CERT-In Directions (2022): providers you depend on must report incidents within 6 hours and keep logs 180 days in India; VPN, VPS and cloud providers must keep subscriber records. Make sure your contracts give you timely notice and access to relevant logs
• Telecom: ISPs operate under licences and conditions from the Department of Telecommunications under the Telecommunications Act 2023
• DPDP Act 2023: a provider that processes personal data on your behalf is a processor and needs a contract (s.8(2)); you stay responsible for safeguards (s.8(5))
• PCI DSS v4.0.1 12.8.1–12.8.5: manage third-party service providers, including network and managed security providers, with written agreements and monitoring of their compliance status

Scope and Applicability

What the Control Covers

• External network services: internet access, MPLS and SD-WAN, leased lines, mobile data for devices, DNS, CDN, DDoS protection, secure web gateways, VPN or ZTNA services, managed firewalls, managed detection and response
• Internal network services run by your own teams for the business
• Rules for using networks and network services (who, what, how, from where)

Size-Based Applicability

Key Definitions

Relationship to Other Controls

Detailed Implementation Guidance

Step 1: Build a Network Service Register

List each network service, its provider (or internal team), what depends on it, its criticality, and the security requirements you need. Include managed security services, which often have privileged access to your environment.

Step 2: Define Security Requirements per Service

Step 3: Put Requirements in the Contract

Use a network service security schedule (see the toolkit) covering: security features; service levels; incident notification (in hours, so you can meet the CERT-In 6-hour clock); access to relevant logs; vulnerability and change management; data location and handling; subcontracting; right to audit or acceptance of independent assurance; exit and transition.

Step 4: Check and Monitor the Provider

• Collect and review attestations (ISO 27001 certificate scope, SOC 2 report) when contracting and at least annually
• Track SLA performance, incidents and changes; hold periodic service reviews
• Review the provider's access to your environment (especially managed security providers) and remove what is not needed

Step 5: Set Rules for Using Networks and Services

Write rules that cover 27002 (a)–(g): which networks and services may be used; authentication and authorisation; technical controls; means of access (company VPN or ZTNA rather than open public Wi-Fi for internal systems); conditions such as location, time and device state; and monitoring of use.

Step 6: Configure Security Features

Apply the provider's security features you are paying for: encryption options, DNSSEC, DDoS profiles, CDN caching rules that respect confidentiality, connection restrictions, and logging into your SIEM.

Network Services Security Policy (Template)

Network Services Security Policy: [Organisation] (A.8.21)

1. All network services (internal and external) are recorded in the network service
   register with owner, provider, criticality and security requirements.

2. Contracts for network services include the network service security schedule:
   security features, service levels, incident notification within [x] hours, access to
   relevant logs, change control, data location, subcontracting, right to audit or
   independent assurance, and exit.

3. Provider security is checked at contracting and reviewed at least annually, using
   attestations and service performance; findings are tracked to closure.

4. Managed service providers with access to our environment use named accounts with
   MFA; their access is logged, reviewed quarterly and removed when not needed.

5. Staff may access internal systems only through approved networks and services
   ([VPN/ZTNA]); open public Wi-Fi is used only through these services.

6. Access to network services depends on authentication, authorisation and, where set,
   device, location and time conditions; use is monitored.

7. CDN and caching settings must not cache personal or confidential content.

Owner: [Head of Network]   Approved by: [CISO]   Review: annual

Risk Assessment and Treatment

Audit and Compliance Checklist

Metrics and KPIs

Common Pitfalls

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Fintech and Its Managed Firewall Provider

Situation. A Mumbai fintech outsourced firewall management. The provider's engineers used a shared admin account without MFA, and the contract had no incident notification clause. When the provider suffered a breach, the fintech heard about it from the news days later.

What changed. Named MFA accounts for each engineer with logged sessions; a security schedule requiring notification within [4] hours, log access and annual independent assurance; quarterly access reviews; and an exit plan.

Lesson. The provider's security is your security; the contract is where you make it enforceable.

Illustrative Scenario 2: Retailer's CDN Caching

Situation. An e-commerce company's CDN cached account pages for a few minutes to improve performance; some customers briefly saw other customers' order details.

What changed. Caching rules were rewritten to bypass the cache for authenticated pages, tests were added to releases, and CDN configuration changes now go through change management.

Lesson. 27002 8.21 explicitly asks you to set caching parameters with confidentiality in mind.

Maturity Model

Figure · Tiers

Maturity levels for security of network services

Multi-Framework Mapping

FAQ

How is A.8.21 different from A.8.20?

A.8.20 secures your networks and devices. A.8.21 covers the network services you use, whether internal or bought, and the rules for using them, including provider security, service levels and assurance.

Is an ISO 27001 certificate from our ISP enough?

It helps, but check the scope (does it cover the service you buy?) and consider SOC 2 reports, contract terms and your own monitoring. 27002 suggests a right to audit or third-party attestations.

What should a network service contract include?

Security features, service levels, incident notification in hours, access to relevant logs, change control, data location, subcontracting, right to audit or independent assurance, and exit terms.

Does A.8.21 cover remote access?

Yes, through the rules on use of networks and services: which networks and services, authentication, authorisation, means of access (VPN or ZTNA), and conditions such as device, location and time.

Who owns A.8.21?

Usually the head of network or infrastructure, with Procurement for contracts and the CISO for requirements and assurance.

References and Further Reading

Standards

• ISO/IEC 27001:2022 Annex A 8.21; ISO/IEC 27002:2022 8.21.
• ISO/IEC 27036 series: information security for supplier relationships.

Frameworks

• NIST SP 800-53 Rev 5: SA-9, SC-7(4), AC-17. NIST CSF 2.0: GV.SC.
• CIS Controls v8: Control 15. PCI DSS v4.0.1: 12.8.

Indian law and regulation

• RBI Master Direction on Outsourcing of Information Technology Services (2023).
• SEBI CSCRF (2024); IRDAI (2023).
• CERT-In Directions of 28 April 2022.
• Telecommunications Act 2023; DPDP Act 2023 s.8(2), s.8(5).

Singahi resources: related guides for A.5.19 Information security in supplier relationships, A.5.23 Information security for use of cloud services, A.8.20 Networks security and A.8.22 Segregation of networks.