Auditors ask for network segmentation audit evidence that proves your intended network boundaries are documented, technically enforced, reviewed, and effective in practice. For ISO/IEC 27001:2022 Annex A control 8.22, expect to show approved architecture, firewall and access-control configurations, change records, monitoring outputs, and test results tying segregation decisions to risk. The strongest audit package lets an assessor trace one sensitive system from its documented zone to the rules that protect it and the evidence that those rules continue to operate.
What does an assessor actually check for under ISO 27001 control 8.22?
Control 8.22 requires that groups of information services, users, and information systems be segregated in the organization’s networks. An assessor is not normally looking for a particular vendor, a prescribed number of VLANs, or a perfect zero-trust architecture. They are looking for a defensible design decision, consistent implementation, and evidence that the organization can prevent or tightly control inappropriate paths between network groups.
- Approved segmentation design and scope: A current network diagram, data-flow diagram, or zone matrix showing meaningful boundaries such as user, production, management, backup, cloud, guest, and third-party access networks. The artifact should identify sensitive services, system owners, trust boundaries, and permitted communications.
- Technical enforcement records: Exported firewall policies, cloud security-group rules, network access-control policies, routing controls, and VLAN or subnet assignments. Assessors commonly select a few rules and compare them with the approved design rather than reviewing every rule.
- Access and administrative-path restrictions: Evidence that administrators reach production systems through controlled routes, such as a privileged-access management gateway, jump host, VPN with multifactor authentication, or a dedicated management subnet. Shared administrator credentials and broad any-to-any management rules receive close attention.
- Change-management traceability: Tickets and approvals for representative segmentation changes, especially new firewall rules, cloud security-group changes, vendor remote-access exceptions, and temporary rules. The ticket should show the business reason, risk review, approver, implementation date, and validation result.
- Operating-effectiveness evidence: Periodic firewall-rule reviews, vulnerability-scan results, penetration-test findings, flow logs, or test scripts showing that prohibited paths are blocked and required paths work. A policy alone is not proof that segmentation is functioning.
For a compliance officer, the practical objective is to create a chain of proof: risk or system classification led to a boundary decision; the boundary was approved; the network and cloud controls implement it; changes are governed; and testing verifies the result. That chain is far more persuasive than supplying a large folder of screenshots without context.
How do you build a pre-audit network segmentation audit evidence map?
Build the map before requesting exports from technical teams. It prevents duplicate collection, identifies evidence that is stale, and gives every artifact a named custodian. Good segmentation evidence is time-bound: include the collection date, applicable environment, and the review period covered.
| Tool or source | Evidence to collect | Location | Owner |
|---|---|---|---|
| Palo Alto Panorama | Running configuration export; security-rulebase for production, management, and vendor VPN zones; rule hit counts; last rule-review approval | Panorama > Managed Devices > Export named configuration snapshot; GRC evidence repository |
Network Security Manager |
| AWS Organizations and AWS Security Hub | VPC diagrams, route tables, security groups, network ACLs, Transit Gateway attachments, and findings for unrestricted inbound rules | AWS Config aggregator: prod-us-east-1; Security Hub compliance export |
Cloud Platform Lead |
| Cisco ISE | Network-access control policy sets, device profiling rules, guest-network isolation policy, and authentication logs for privileged network access | Policy > Policy Sets > Corporate-Wired; monthly access-control review folder |
Infrastructure Operations Manager |
| ServiceNow | Approved changes for firewall, routing, VPN, and cloud security-group modifications during the audit period | Change > All; filter: category=Network Security |
IT Service Management Lead |
| Tenable.io | Authenticated scan reports demonstrating scanner placement, reachable assets by zone, and remediation status for exposed management services | Scans > Prod Internal Quarterly |
Vulnerability Management Lead |
| Splunk Enterprise | Firewall deny events, VPN connections, and sample alerts for attempted cross-zone access during the selected review period | index=pan_traffic action=deny; saved search exports |
Security Operations Manager |
Use a simple evidence index alongside this table: artifact name, control reference, system scope, owner, collection date, retention location, and assessor request status. This makes it easy to answer follow-up questions without searching through collaboration sites during the interview.
For example, Harborline Clinical Systems, a 430-person healthcare technology vendor, operates a patient-engagement SaaS platform across AWS and a small corporate office network. Its relevant zones are corporate users, production application workloads, production data services, engineering tools, vendor support access, and security management. Its evidence package should show that customer-support personnel cannot directly reach production databases; that engineers use an MFA-protected VPN and privileged jump host; and that a support vendor’s access is restricted to a time-limited remote-support subnet. The auditor does not need every application detail; they need to see that the declared boundaries match the actual access paths.
What are the top three gotchas that cause segmentation audit findings?
1. The diagram says “segmented,” but the rulebase permits broad access
A common gap is a polished diagram showing separate production and corporate zones while a firewall rule allows Corporate-Users -> Production-Servers : any/any for convenience. A broad rule may be justified temporarily, but it must be documented, approved, time-bound, and reviewed. Assessors often ask technical staff to demonstrate one supposedly restricted path live or through a configuration export.
2. Cloud environments are excluded from the story
Organizations sometimes provide detailed office firewall evidence while treating cloud networks as an engineering concern. If production workloads, backups, CI/CD services, or administrative tools run in AWS, Azure, or another cloud platform, they are in scope for evidence of network segregation. Security groups, route tables, private endpoints, peering connections, and identity-based administrative access are all relevant to the control.
3. Exceptions exist, but nobody can show who approved them
Vendor VPN access, temporary firewall openings, scanner exemptions, and legacy application dependencies are reasonable areas for exceptions. They fail when they are permanent in practice, unnamed in the risk register, or unsupported by a change record. An exception should identify the affected zones, business purpose, compensating safeguards, expiration or review date, and accountable owner.
At Harborline, a review found an old rule allowing the office subnet to reach a production integration server on multiple ports. The system owner confirmed that only HTTPS from a specific integration service was required. Replacing the broad rule, linking the change to the application dependency record, and retaining a successful connectivity test converted a likely finding into clear evidence of a controlled improvement.
What should your 7-day pre-audit countdown include?
- Day 7: Confirm the audit scope, in-scope sites, cloud accounts, critical systems, and the named technical owners who can answer questions.
- Day 6: Compare the latest network and data-flow diagrams with current firewall zones, cloud VPCs or VNets, remote-access paths, and management networks.
- Day 5: Export dated configurations and rule-review reports; preserve them in a read-only audit folder rather than relying on live console access.
- Day 4: Select two or three representative access paths to test: a prohibited user-to-production path, an approved administrative path, and a controlled third-party path.
- Day 3: Pull the associated ServiceNow changes, approvals, risk acceptances, and validation records for those access paths.
- Day 2: Reconcile gaps. Escalate undocumented broad rules, expired temporary access, missing asset owners, and diagrams that do not reflect deployed systems.
- Day 1: Hold a 30-minute evidence walkthrough with the network, cloud, security, and compliance owners; agree who will demonstrate each artifact and how follow-up requests will be tracked.
Do not manufacture evidence or backdate reviews during this countdown. If a weakness is found, document it honestly, open a corrective-action record, establish an owner and target date, and be prepared to explain the compensating controls. Assessors generally respond better to a transparent, governed remediation plan than to contradictory records.
What should you do during the assessor interview?
Start with the approved segmentation model and explain why the boundaries exist: protecting production services, restricting privileged administration, isolating third parties, or limiting user access to sensitive systems. Then use one representative scenario to connect design, configuration, change approval, and test result. Keep the discussion evidence-led rather than architecture-led.
- Answer the question asked, then provide the specific artifact; avoid volunteering unrelated technical detail that creates new lines of inquiry.
- Have the control owner explain the governance decision and the technical owner demonstrate the enforcement setting. This avoids a compliance-only explanation that cannot be validated.
- When showing a rule, identify source zone, destination zone, service or port, application or system owner, business justification, approval record, and last review date.
- If an answer is not available, say so, log the request, assign an owner, and provide a committed follow-up time. Never guess about whether access is possible.
- Record every evidence request and verbal clarification in an interview log, including the final artifact supplied and any agreed remediation action.
Before the audit begins, assign owners to the evidence map and run one representative access-path walkthrough so your ISO 27001 control 8.22 story is complete, current, and easy to verify.
