Tutorials · IT Leadership
How to Map Network Security Controls to ISO 27001 and NIS2
Auditors and regulators ask how your network is protected. Map practical network controls to ISO/IEC 27001:2022 Annex A and to the NIS2 risk-management measures, and collect the evidence.
Before you start
- Your ISO 27001 scope or NIS2 obligations
- Network documentation and access to configurations and logs
Step by step
Know the key ISO 27001:2022 controls
Network-related Annex A controls include 8.20 Networks security, 8.21 Security of network services, 8.22 Segregation of networks, 8.23 Web filtering, 8.15 Logging, 8.16 Monitoring activities, 8.9 Configuration management, 8.8 Management of technical vulnerabilities and 8.13 Information backup.
Know the NIS2 measures
NIS2 Article 21 requires risk-management measures such as incident handling, business continuity and backups, supply-chain security, secure development and maintenance, vulnerability handling, cryptography, access control and MFA. Article 23 requires an early warning within 24 hours and an incident notification within 72 hours for significant incidents.
Map your controls
Create a table: control, what you do (VLAN segmentation, firewall rule reviews, 802.1X, MFA for admins, config backups, logging to SIEM), owner and evidence.
Collect evidence
Diagrams, firewall rule review records, scan reports, patch and firmware records, backup restore tests, log retention settings, training records.
Close the gaps
Turn missing controls into a prioritised plan with owners and dates.
Review regularly
Review controls and evidence at least yearly and after major changes or incidents.
Pro tips
- Supply-chain security includes your network vendors: ask for their vulnerability handling and patch policy.
- Keep evidence in one place so audits take days, not weeks.
FAQ
Frequently asked questions
Does NIS2 apply to us?
It depends on your sector, size and country, as each EU member state transposes the directive. Check with your legal or compliance team.
Keep learning
Related guides
Start zero trust networking
Read more →Build a free SIEM with Wazuh
Read more →Scan for vulnerabilities
Read more →How to Plan and Justify an IT Network Budget (With a Free Calculator)
A step-by-step method for CTOs and IT managers to build a network budget: inventory, sizing, one-time and recurring costs, contingency and a business case management will approve. Includes a free budget calculator.
Read more →How to Compare Total Cost of Ownership: Cloud-Managed vs On-Premises Network Management
Price per device is only part of the cost. Compare 5-year total cost of ownership for cloud-managed and on-premises controllers: hardware, licences, staff time, downtime and travel.
Read more →How to Plan a Network Refresh and Hardware Lifecycle
Old switches, access points and firewalls are slower, less secure and eventually unsupported. Build a lifecycle plan that spreads replacements over years instead of emergencies.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.