Draft v0.1.05 of 6 frameworks
Network security and segmentation
Firewalls and network security controls restrict traffic; sensitive environments are segmented from untrusted networks.
Where it appears
- SOC 2
CC6.6Implements logical access security measures against threats from outside system boundaries- PCI DSS 4.0
1.2Network security controls are configured and maintained1.3Network access to and from the cardholder data environment is restricted1.4Network connections between trusted and untrusted networks are controlled- NIST CSF 2.0
PR.IR-01Networks and environments are protected from unauthorized logical access and usage- ISO 27001:2022
A.8.20Networks securityA.8.21Security of network servicesA.8.22Segregation of networks- HIPAA Security Rule
- no direct requirement
- NIST 800-53 r5
SC-7Boundary protectionAC-4Information flow enforcement
No direct HIPAA Security Rule citation; network safeguards are expected to come out of the risk analysis.
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Network diagram and data-flow diagram, reviewed within the last 12 months
- Firewall / security-group rule sets with business justification for each rule
- Evidence of periodic firewall rule review
- Segmentation evidence for sensitive environments (and segmentation testing where required)
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0NIST CSF 2.0 to ISO 27001:2022NIST CSF 2.0 to NIST 800-53 r5