ISO/IEC 27001:2022 · derived mapping target
A.8.22Segregation of networks
Separate groups of systems, users and services on your networks so a problem in one area does not spread freely to others.
Mapping at a glance
A.8.22Segregation of networksISO/IEC 27001:2022
A.8.22 is covered by 10 Sekit CSF controls. +5 more in the table below. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0169Network segmentation · PolicysupportsThe network segmentation policy facet names the zones and the traffic rules between them, the written boundary A.8.22 needs before enforcement can follow.RCF-0170Network segmentation · ProcesssupportsThe process facet reviews zone boundaries and inter-zone rules on a recurring schedule, keeping A.8.22's segmentation current as the network changes.RCF-0171Network segmentation · TechnicalenablesThe technical facet enables VLANs and firewall rules to enforce zone boundaries by default-deny, the mechanism that turns A.8.22's segmentation policy into a real barrier.RCF-0192Wireless security · TechnicalsupportsThe wireless technical facet enforces WPA2 or WPA3 encryption and an isolated guest network with no path to management interfaces, applying A.8.22's segmentation to the wireless side.RCF-0349Multi-tenancy controls · PolicysupportsThe multi-tenancy policy facet addresses in writing how tenant data stays separated in shared environments, extending A.8.22's segmentation principle to the application layer.RCF-0350Multi-tenancy controls · ProcesssupportsThe process facet verifies tenant boundaries on a recurring basis and treats any cross-tenant exposure as a defect to fix immediately, the operational check A.8.22 relies on at the application layer.RCF-0351Multi-tenancy controls · TechnicalenablesThe technical facet enables per-tenant scoping in every data query plus platform-level isolation, so cross-tenant access stays blocked even if application code has a bug, the depth A.8.22 needs at the application layer.RCF-0421Network segmentation (ICS) · PolicysupportsThe ICS segmentation policy facet mandates that production control systems live on their own network with every crossing point approved, applying A.8.22 to operational technology.RCF-0422Network segmentation (ICS) · ProcesssupportsThe process facet keeps the IT/OT boundary controlled, reviewing cross-boundary traffic and removing connections that no longer have a reason, the recurring check A.8.22's ICS scope needs.RCF-0423Network segmentation (ICS) · TechnicalenablesThe technical facet enables the IT/OT separation with a firewall permitting only the specific flows production needs and one-way data paths where the plant only publishes outward, the enforcement A.8.22 requires for ICS zones.
NIST CSF 2.0 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
Cyber Essentials counterparts
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Network architecture diagram
The drawing or schematic showing how the company's systems connect: networks, firewalls, segments, and links to the internet and the cloud.
Wireless network configuration
How the company's Wi-Fi is secured: encryption, a separate guest network, and control of access points.
From the Sekit evidence catalog
In practice
Segmentation often exists on a diagram but not in the firewall rules: a guest Wi-Fi network shares a VLAN with corporate laptops, and nobody has reviewed the rule set since it was first configured. Multi-tenant software carries the same risk one layer up, where a missing organization-id filter on a single query can let one customer see another's data. A working setup names the network zones and allowed traffic in policy, enforces boundaries with VLANs and default-deny firewall rules, scopes every data query to the requesting tenant, and reviews both on a recurring schedule rather than trusting the original design to hold forever.
Common gaps
The guest Wi-Fi network shares a VLAN with corporate devices, so a compromised guest device can reach systems it was never meant to touch.
Firewall rules between zones were configured once at setup and never reviewed, so nobody can say whether every open path still has a reason.
A data query missing its tenant filter would return another customer's records, and no automated check exists to catch that class of bug before release.
Questions your auditor will ask
How is the guest Wi-Fi network isolated from corporate systems?
The guest network runs on a separate VLAN with encrypted access and no route to internal systems or management interfaces.
What stops one customer's data from being visible to another in your platform?
Every data query is scoped to the requesting tenant at the application and platform layer, verified through recurring access reviews.
How are industrial control systems separated from the office network?
Production control systems sit on their own network, connected to office IT only through an approved, firewalled crossing point.
Can you show me the network architecture diagram, and does it match the firewall rules?
Yes, the network architecture diagram shows every zone and its boundary, and the firewall rule set is reviewed against it on a recurring schedule.
Where regulation demands it
NIS2 6.8 requires network segmentation as a specific security measure, and ENS mp.com.4 requires the same separation of information flows across the network.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves A.8.22?”
Also via MCP, free with account