A.8.21 Technological
Security of network services
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (14)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-17mostlyaligns with — Both controls require organizations to define and enforce security requirements for remote or external network connections, including authentication, authorization, and monitoring of provider-managed services.
- AC-18mostlyaligns with — Both controls address the need to establish rules and technical controls governing access to wireless and other network services, including permitted usage and security features.
- AC-3mostlyaligns with — Both controls focus on enforcing authorization decisions that determine which users or entities may access specific network services and connections.
- AC-2partialaligns with — Both controls require procedures to manage who is permitted to access networks and services, including authentication and authorization tied to user accounts.
- AU-2partialaligns with — Both controls require monitoring and logging of network service usage to detect unauthorized or non-compliant access.
- CA-3partialaligns with — Both controls require organizations to establish security and monitoring expectations when exchanging information or services with external network providers.
- SC-7partialaligns with — Both controls emphasize implementing boundary and connection controls to protect access to network services from unauthorized or insecure entry points.
Aligned NIST CSF 2.0 outcomes (13)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- DE.CM-01mostlyaligns with — Requiring ongoing monitoring of network service usage and the provider’s performance implements continuous monitoring of networks to detect potentially adverse events.
- GV.SC-05mostlyaligns with — The control requires contractual and operational security requirements to be defined and enforced with network service providers, which directly supports embedding cybersecurity obligations into supplier agreements.
- GV.SC-07mostlyaligns with — Regular monitoring of the provider’s ability to deliver services securely and the use of third-party attestations both contribute to understanding and recording supplier risk.
- PR.AA-05mostlyaligns with — Defining and enforcing authorization procedures that determine who may access which networks and services directly addresses the management of access permissions and entitlements.
- PR.IR-01mostlyaligns with — Specifying authentication, encryption, connection controls, and authorization procedures for network services implements logical protections against unauthorized network access and usage.
- ID.AM-03partialaligns with — Documenting allowed networks, access methods, and connection rules contributes to maintaining representations of authorized network communication flows.
- PR.AA-03partialaligns with — Specifying authentication requirements and technical parameters for secure connections supports the authentication of users, services, and hardware accessing network services.
Related OWASP ASVS 5.0 requirements (12)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V13.2.4mostlycovers — The ISO control's requirement to define and enforce an allowlist of permitted networks and services directly implements the ASVS mandate that applications only communicate with explicitly approved external resources.
- V13.2.5mostlycovers — Specifying which resources a server may contact and restricting outbound connections aligns with the ISO guidance on formulating rules for allowed network access and technological controls.
- V12.3.5partialaligns with — Mandating strong authentication for internal service-to-service communications within the network aligns with the ASVS requirement that intra-service communications use strong authentication to ensure each endpoint is legitimate.
- V6.3.1partialaligns with — Requiring authentication and authorization procedures for network services supports the ASVS requirement for controls that defend against credential stuffing and brute-force attacks on authentication pathways.
- V8.2.1partialaligns with — The ISO control's authorization procedures for determining who may access which network services map to the ASVS requirement that function-level access be restricted to consumers with explicit permissions.
Related weaknesses / CWE (58)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1125←P →PCWE-1327←P →MCWE-1385←PCWE-200→PCWE-284→PCWE-287→PCWE-288→PCWE-291←P →PCWE-297←PCWE-300←P →PCWE-306→PCWE-319→MCWE-322→PCWE-345→PCWE-346←P →PCWE-348←PCWE-350←P →PCWE-353←P →PCWE-400→PCWE-406→PCWE-419←P →PCWE-420←P →PCWE-437←PCWE-444←PCWE-5←P →PCWE-523→PCWE-605←P →PCWE-757→PCWE-862→PCWE-923←P →PCWE-924←P →MCWE-940←PCWE-941←PCWE-942←P
Why these map — AI rationale (under review)
- CWE-1327mostlyprevents — Security of network services includes hardening service bindings to prevent exposure on all interfaces.
- CWE-319mostlyprevents — Specifying encryption and other security technology for network services prevents transmission of sensitive information in cleartext over potentially untrusted channels.
- CWE-924mostlyprevents — Addresses security of network services, which may include integrity mechanisms.
- CWE-1125partialmitigates — Restricting network services reduces exposed interfaces, though broader attack-surface decisions may still remain.
- CWE-200partialprevents — Encryption, connection controls, and monitoring of network service usage reduce the chance that sensitive data traversing or accessible via those services will be exposed to unauthorized observers.
- CWE-284partialprevents — Defining allowed networks, authentication requirements, authorization procedures, and access attributes directly enforces who may reach which services, blocking unauthorized entry paths that improper access control would otherwise leave open.
- CWE-287partialmitigates — Requiring authentication mechanisms and technical parameters for secure connections ensures that network services verify user identity before granting access, preventing exploitation of missing or weak authentication.
- CWE-288partialmitigates — Security of network services may restrict alternate paths but does not enforce authentication requirements.
- CWE-291partialmitigates — Security of network services includes authentication mechanisms beyond source IP.
- CWE-300partialmitigates — Security of network services includes measures to verify endpoints and protect channel integrity.
- CWE-306partialmitigates — Mandating authentication for network services and critical functions stops attackers from invoking sensitive operations without credentials, closing gaps where authentication is absent for important capabilities.
- CWE-322partialmitigates — Security of network services includes requirements for authenticated key exchange in service protocols.
- CWE-345partialmitigates — Secure network services often include authenticity checks for data exchanged over those services.
- CWE-346partialmitigates — Security of network services includes validating the authenticity of service endpoints.
- CWE-350partialmitigates — Secure network services discourage use of unauthenticated reverse-DNS for access decisions.
- CWE-353partialprevents — Security requirements for network services can require integrity checks on data in transit.
- CWE-400partialprevents — Monitoring network service usage and applying controls to restrict access when necessary limits an attacker’s ability to consume excessive resources through unrestricted or unauthenticated service calls.
- CWE-406partialmitigates — Security of network services can impose volume controls on specific services, but does not address the weakness broadly.
- CWE-419partialprevents — Security of network services can enforce protection on the primary channel.
- CWE-420partialprevents — Security of network services requires consistent protection across all service channels, mitigating alternate-channel weaknesses.
- CWE-5partialprevents — Requires security measures for network services, which include encryption of transmitted data.
- CWE-523partialprevents — Addresses security of network services, which may include protecting authentication traffic.
- CWE-605partialmitigates — Security of network services includes configuration to prevent unauthorized services from binding to privileged ports.
- CWE-757partialmitigates — Ensures network services use secure cryptographic parameters, reducing downgrade risk.
- CWE-862partialmitigates — Authorization procedures and rules that determine who may access specific networks and services ensure that every request is checked for the required permissions before access is granted.
- CWE-923partialprevents — Security of network services includes authentication of endpoints and service-to-service channel protection.
- CWE-1385nonenone — Secure configuration of network services can include origin checks for WebSocket endpoints.
- CWE-207nonenone — Securing network services can mask observable discrepancies between equivalent products.
- CWE-296nonemitigates — Secure network services depend on correct certificate chain validation.
- CWE-297nonenone — Security of network services requires proper TLS configuration and certificate validation for service endpoints.
- CWE-299nonenone — Security of network services includes certificate-based authentication and revocation checks.
- CWE-348nonenone — Secure network services include source validation and integrity checks that help prevent acceptance of data from less-trusted origins.
- CWE-437nonenone — Defining security requirements for network services can include explicit endpoint feature negotiation and state tracking.
- CWE-444nonenone — Secure network services include hardening proxies and gateways against inconsistent HTTP interpretation.
- CWE-940nonemitigates — Security of network services includes validating the origin of service requests and connections.
- CWE-941nonenone — Security of network services includes service endpoint verification, mitigating incorrect destination specification.
- CWE-942nonenone — Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.
Mitigated MITRE ATT&CK techniques (6)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1021mostlyprevents — Requiring authentication, authorization, and connection controls for network services limits an adversary's ability to abuse remote services for lateral movement.
- T1133mostlyprevents — Defining allowed networks, authentication rules, and monitoring for external network services restricts adversaries from establishing persistent external remote access.
- T1046partialmitigates — Authorization procedures and network service access rules limit an adversary's ability to discover and enumerate network services across the environment.
- T1078partialmitigates — Enforcing authentication requirements and monitoring network service access reduces the effectiveness of using stolen or misused valid accounts.
- T1090partialmitigates — Requiring approved access methods and monitoring network service usage hinders adversaries from establishing or using proxies for command and control.
- T1571partialmitigates — Specifying permitted network services, ports, and connection methods makes it harder for adversaries to communicate over non-standard ports without detection.
Prevented OWASP Web Top 10 (2025) risks (3)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A02mostlyprevents — Requiring documented security features, technical parameters, and regular monitoring of network service providers reduces the chance that default or insecure configurations are left in place on the network layer that applications depend on.
- A01partialprevents — By mandating explicit authorization procedures, authentication requirements, and attribute-based access rules for network services, the control directly enforces who can reach which resources and thereby stops unauthorized traversal of application boundaries.
- A07noneprevents — Specifying authentication requirements and attribute checks (time, location, etc.) for network service access directly strengthens the mechanisms that verify user or system identity before granting entry.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.