Which standards require a network security policy?

ISO/IEC 27001:2022: 8.20, 8.21, 8.22; The NIS2 Directive: Art. 21(2)(j).

What must a network security policy contain under ISO 27001?

8.20: Secure, manage and control networks and network devices. 8.21: Identify, implement and monitor security mechanisms and service levels for network services. 8.22: Segregate groups of services, users and systems in the network. The ISO 27002 guidance beside 8.20: Requires networks and network devices to be secured, managed and controlled in order to protect the information carried in systems and applications.

Who should own the network security policy?

The clauses imply the head of IT operations. The register names the role so the line on your list can carry a name.

How often should a network security policy be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a network security policy?

Yes: https://compliance.theartofservice.com/policy-templates/network-security-policy

Every policy type · Operations and technology

Network security policy

How networks are designed, segmented, filtered and monitored, which services are exposed and how remote connections are made.

How the register reads it

Also called	firewall policy, network segmentation, remote access policy
Family	Operations and technology
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected owner	The head of IT operations.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	ISO 27001 is ticked and no line resolves to it (NIS2 requires it too, inside a parent document, so it does not list it separately).
Template	Network security policy.

Which standards require it, and what each expects it to contain

4 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.20 Networks security

Secure, manage and control networks and network devices.

What the ISO 27002 guidance expects the document to say: Requires networks and network devices to be secured, managed and controlled in order to protect the information carried in systems and applications.

Evidence an auditor accepts: Network documentation showing the current topology, zones, connections and the security controls at each boundary; configuration standards for network devices and evidence of compliance, including management plane protection; firewall and access control rule sets, with evidence of periodic review and removal of obsolete or overly permissive rules
Common gap: outdated topology diagrams
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 8.21 Security of network services

Identify, implement and monitor security mechanisms and service levels for network services.

What the ISO 27002 guidance expects the document to say: Requires the security mechanisms for network services, along with their service levels and the requirements placed on them, to be identified, implemented and monitored, whether provision is in house or outsourced.

Evidence an auditor accepts: Identification of network services in use, whether in house or outsourced, with their owners; the security mechanisms, service levels and management requirements defined for each service; evidence of implementation of those mechanisms, such as encryption, authentication and connection controls
Common gap: Out‑of‑date service inventory missing recent cloud assets
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 8.22 Segregation of networks

Segregate groups of services, users and systems in the network.

What the ISO 27002 guidance expects the document to say: Requires segregation within the organisation's networks, keeping groups of information services, of users and of systems apart from one another.

Evidence an auditor accepts: The segregation design, showing the defined zones and the criteria placing systems, services and users into each; enforcement evidence at each boundary, such as firewall rules, access control lists or micro segmentation policy; evidence of segregation for wireless, guest, third party, management and operational technology networks
Common gap: Informal or outdated network maps used instead of documented diagrams
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

The NIS2 Directive

NIS2 Art. 21(2)(j) Multi-factor or continuous authentication, secured communications and secured emergency communications

This point pulls together the authentication and communications controls the Directive names explicitly. Multi-factor authentication, or continuous authentication solutions in its place, is expected where appropriate, and the interesting question is always coverage: remote access, administrative access, and access to the systems behind the essential service are where absence matters most. Secured voice, video and text communications within the entity is the second limb. The third, secured emergency communication systems, is the one most often absent, and it is the one that decides whether the entity can coordinate during an incident in which its normal collaboration and directory services are unavailable or untrusted. A crisis plan that runs on the corporate messaging platform does not satisfy this if that platform is what has been compromised.

Evidence an auditor accepts: Coverage report for multi-factor or continuous authentication across remote, privileged and essential-service access; the reasoning and compensating controls for any access path left without it; configuration evidence for secured voice, video and text communications within the entity
Common gap: Multi-factor authentication on the corporate portal but not on administrative or machine access paths
Source: NIS2 Directive

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Mobile device policy · Patch management policy