A.8.22 Technological
Segregation of networks
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (10)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-4mostlyaligns with — Both controls enforce information flow restrictions between network segments by requiring gateway controls and policy-based decisions on permitted traffic between domains.
- SC-32mostlyaligns with — The ISO control's use of separate network domains to isolate systems of differing criticality and sensitivity directly supports the NIST objective of partitioning the system into distinct components with defined security boundaries.
- SC-7mostlycovers — Both controls require dividing networks into distinct segments with controlled gateways at the boundaries to enforce security policies based on trust levels and information sensitivity.
- SC-2partialaligns with — Network domain segregation contributes to separating user-facing and system-facing functions by isolating different trust levels and organizational functions into distinct network segments.
- SC-3partialaligns with — By placing security enforcement points (gateways) at domain perimeters, the ISO control supports isolation of security functions from less-trusted network zones.
Aligned NIST CSF 2.0 outcomes (8)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.IR-01mostlycovers — Network domain segregation with perimeter gateways directly implements the outcome of protecting networks and environments from unauthorized logical access.
- ID.AM-03partialaligns with — Mapping domains and their trust boundaries contributes to maintaining representations of authorized network communication and data flows.
- PR.AA-05partialaligns with — Defining and enforcing access rules between network domains through gateways aligns with managing and reviewing access permissions and authorizations.
- PR.PS-01partialaligns with — Establishing domain boundaries and gateway controls is a form of configuration management applied to the network infrastructure.
Related OWASP ASVS 5.0 requirements (10)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V13.2.4mostlycovers — Defining perimeters and controlling inter-domain traffic through gateways implements an allow-list of permitted external or internal communication targets.
- V13.2.5mostlycovers — Gateway-enforced access rules between domains equate to configuring the web or application server with an allow-list of resources it may reach.
- V12.3.5partialaligns with — Segregating networks by trust level and routing traffic through controlled gateways provides the strong authentication and isolation required for intra-service communications.
- V3.5.4partialaligns with — Network-domain segregation based on trust and sensitivity directly supports hosting separate applications on distinct hostnames to enforce same-origin policy boundaries.
- V8.4.1partialaligns with — Dividing networks into domains according to organizational units or risk levels helps ensure that operations in one tenant cannot affect another.
Related weaknesses / CWE (42)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-1125mostlyprevents — Network segregation limits lateral exposure and therefore the effective attack surface.
- CWE-653mostlyprevents — Network segregation is a classic technical control for isolating different privilege domains.
- CWE-1327partialmitigates — Network segregation can limit the blast radius of an unrestricted binding but does not prevent the binding itself.
- CWE-200partialprevents — Limiting which domains can communicate reduces the number of systems that can receive or observe sensitive data, lowering the chance of accidental or malicious exposure.
- CWE-207partialmitigates — Network segregation can prevent attackers from observing behavioral differences across products.
- CWE-284partialmitigates — Network domain segregation with perimeter gateways enforces explicit boundaries and access mediation, directly stopping unauthorized actors from reaching resources they should not touch.
- CWE-285partialmitigates — By requiring gateways to evaluate every cross-domain request against security requirements, the control stops requests from bypassing intended authorization checks.
- CWE-291partialmitigates — Network segregation reduces the attack surface but does not replace authentication.
- CWE-300partialmitigates — Network segregation reduces exposure but does not verify endpoint identity or channel integrity.
- CWE-346partialmitigates — Network segregation reduces exposure but does not directly validate origins.
- CWE-385partialmitigates — Network segregation limits external timing observation but not internal covert timing.
- CWE-402partialmitigates — Network segregation reduces blast radius but does not prevent the product from leaking resources.
- CWE-419partialmitigates — Network segregation can isolate the primary channel from untrusted networks.
- CWE-420partialmitigates — Network segregation can reduce exposure of alternate channels but does not guarantee equivalent protection levels.
- CWE-421partialmitigates — Segregating networks limits the reach of alternate communication paths to unintended parties.
- CWE-509partialmitigates — Network segregation restricts worm propagation across segments.
- CWE-514partialmitigates — Segregating networks reduces inter-zone covert channels, yet leaves intra-zone or process-level channels untouched.
- CWE-515partialmitigates — Network segregation reduces opportunities for covert storage between domains but does not address intra-process channels.
- CWE-553partialmitigates — Network segregation reduces reachability of the vulnerable directory but does not eliminate the weakness.
- CWE-668partialmitigates — Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.
- CWE-669partialmitigates — Network segregation directly limits unintended resource movement between spheres.
- CWE-862partialmitigates — Mandatory gateway enforcement at each domain boundary ensures that missing authorization checks inside an application cannot be reached without first passing an external control point.
- CWE-923partialmitigates — Network segregation reduces exposure but does not itself validate specific endpoints.
- CWE-940partialmitigates — Network segregation limits exposure but does not directly verify source of individual channels.
- CWE-941partialmitigates — Network segregation reduces exposure but does not address destination specification within allowed segments.
- CWE-1189nonenone — Network segregation can reduce exposure of SoC shared resources but does not address internal hardware isolation.
- CWE-488nonenone — Network segregation limits lateral movement but does not enforce application-level session boundaries.
- CWE-501nonenone — Network segregation reduces external mixing but does not address internal data-structure trust violations.
- CWE-673noneprevents — Network segregation reduces external actors' ability to influence sphere definitions across domains.
- CWE-706nonenone — Segregated networks limit the blast radius when a name or reference resolves outside the intended control sphere.
Mitigated MITRE ATT&CK techniques (7)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1021mostlymitigates — Network domain boundaries and gateway controls limit the ability of an adversary to move laterally from a compromised host to other systems by restricting which remote services can be reached across trust zones.
- T1046mostlymitigates — Domain segregation and perimeter gateways restrict the scope of network service discovery, making it harder for an adversary to enumerate services across the entire environment from a single vantage point.
- T1190mostlyprevents — Placing public-facing systems in isolated domains with controlled gateways limits the impact of an exploit against an internet-accessible application by preventing direct access to internal resources.
- T1570mostlymitigates — Gateway-enforced boundaries between domains impede the transfer of tools between compromised hosts located in different network segments.
- T1078partialmitigates — Segmenting networks by trust level and enforcing gateway filtering reduces the blast radius of a compromised valid account, preventing its use to reach higher-sensitivity domains without additional controls.
- T1090partialmitigates — Strict domain separation and gateway inspection make it more difficult for an adversary to establish internal or external proxies that span multiple trust zones without detection or blocking.
- T1563partialmitigates — Domain isolation and gateway filtering make hijacking remote service sessions across network boundaries more difficult for an adversary.
Prevented OWASP Web Top 10 (2025) risks (2)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A02mostlyprevents — Explicitly defining perimeters and enforcing gateway rules between domains counters the common misconfiguration of overly permissive or flat network topologies.
- A01partialprevents — Network domain boundaries and gateway controls limit lateral movement after an initial compromise, thereby reducing the blast radius of unauthorized access attempts.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.