ISO 27001 A.8.21: Security of network services

Map out every network service your organisation uses, both internal and external. For each one, document the provider, security features, SLAs, and the internal person responsible. Define security requirements per service. Think about encryption standards (minimum TLS versions, cipher suite requirements), authentication mechanisms, intrusion detection, DDoS protection, logging and monitoring capabilities, redundancy and failover, incident response procedures, and compliance with relevant standards. For outsourced services, bake security requirements into the contract. Specify what controls the provider must maintain, SLAs for security metrics (like DDoS mitigation response time), incident notification timelines, the right to audit or receive SOC 2 reports, and data protection obligations for any data the provider can access. Monitor your network services continuously. Use network monitoring tools to verify availability and performance. Watch for security events - DDoS attacks, routing anomalies, degradation. Review provider security reports and audit results on a regular schedule. Track SLA compliance and escalate breaches. Deploy your own security controls at service boundaries. Put firewalls and IPS at ingress and egress points. Implement DDoS mitigation for internet-facing infrastructure. Use DNSSEC where supported. Configure secure routing with BGP authentication. Review network service arrangements periodically. Check whether security requirements are still being met. Evaluate whether the provider's security posture is still adequate given changes in the threat landscape. Have a transition plan ready if you need to switch providers.