ISO 27033 network security is the ISO/IEC multi-part standard that gives concepts, design, and implementation guidance for securing networks. It translates the abstract network controls in ISO/IEC 27001 Annex A into concrete engineering practice, covering architecture, threats, security gateways, VPNs, wireless access, and network virtualization across seven complementary parts.
Most security teams know ISO/IEC 27001 and its companion ISO/IEC 27002 well. Far fewer have opened ISO/IEC 27033, even though it is the standard that answers the question those documents deliberately leave open: how do we actually secure the network? ISO 27001 tells you to implement appropriate network security controls, and ISO 27002 offers high-level direction. ISO 27033 is where the operational detail lives, written for the architects, designers, and engineers who build and run the network.
What ISO/IEC 27033 covers
ISO/IEC 27033 is a guidance standard, not a certifiable management system. You cannot be audited against it the way you are against ISO 27001. Instead, it provides a shared vocabulary and a structured set of techniques so that everyone from a network architect to a security officer can identify network security risks, define requirements, and select proportionate controls. It applies to the security of devices, the management activities around those devices, the applications and services running over the network, and the end users who depend on it.
The series descends from the older five-part ISO/IEC 18028 and has since grown and modernized. Each part is self-contained but designed to be read alongside Part 1, which acts as the map to everything else.
The seven parts of ISO/IEC 27033 explained
The standard is organized so that you can start with the overview and then drill into whichever technical area matters for your environment. Here is the full series and what each part delivers.
- Part 1 (27033-1) — Overview and concepts: defines terminology and maps to the other parts and to ISO 27001 Annex A network controls.
- Part 2 (27033-2) — Guidelines for design and implementation: introduces network security architecture, requirements, and design principles.
- Part 3 (27033-3) — Reference networking scenarios: describes typical scenarios with their threats, design techniques, and control issues.
- Part 4 (27033-4) — Securing communications between networks using security gateways: risks, design, and controls for firewalls and gateways.
- Part 5 (27033-5) — Securing communications across networks using VPNs: guidance on virtual private networks and secure tunneling.
- Part 6 (27033-6) — Securing wireless IP network access: threats and controls for wireless connectivity.
- Part 7 (27033-7) — Guidelines for network virtualization security: risks and controls for virtual network infrastructure and functions, published in 2023.
Part 1 is the natural entry point because it explains how the pieces fit together and cross-references the network-related Annex A controls. Parts 2 and 3 are the design and threat-modeling backbone. Parts 4 through 7 are the technology-specific playbooks you reach for when you are securing a particular slice of the network.
Why Part 7 matters now
Part 7 is the newest addition, published in December 2023, and it reflects how networks have changed. Software-defined networking, virtual network functions, and cloud fabrics introduce risks that the earlier parts did not fully anticipate. Part 7 helps teams responsible for virtualization environments define and implement the technical controls needed to keep virtual networks trustworthy, which is increasingly where real-world workloads actually run.
Gartner estimated that through 2023, 99% of firewall breaches would be caused by misconfigurations rather than firewall flaws (Gartner, cited widely across the security industry, 2016 forecast for 2023). That is exactly the failure mode ISO/IEC 27033-4 is designed to reduce.
How ISO 27033 supports ISO 27001 Annex A
The ISO 27001:2022 Annex A control 8.20 on network security requires organizations to secure and manage networks and network devices to protect information. That control is deliberately outcome-focused, which is appropriate for a management system standard but unhelpful when an engineer needs to know how to segment a network or harden a gateway.
This is where ISO 27033 earns its place in an ISMS. For each network-related Annex A control an organization implements, the relevant part of 27033 supplies the operational guidance the control statement omits. Part 1 provides the explicit cross-references, so auditors and implementers can trace a high-level requirement down to a concrete design technique. Used together, ISO 27002 gives the control intent and ISO 27033 gives the engineering method.
- Segmentation and architecture decisions map to Parts 2 and 3.
- Perimeter and inter-network controls map to Part 4 on security gateways.
- Remote and site-to-site connectivity maps to Part 5 on VPNs.
- Wireless access controls map to Part 6.
- Virtualized and cloud network controls map to Part 7.
How to use the series in practice
You do not need to read all seven parts cover to cover. A practical approach is to start with Part 1 for orientation, use Part 2 and Part 3 to shape your network security architecture and threat model, and then pull in the technology-specific parts as your environment demands them. Document the mapping between your chosen controls and the 27033 guidance you followed, because that traceability is exactly what a Stage 2 ISO 27001 auditor wants to see when reviewing network control 8.20.
For teams pursuing certification, treating ISO 27033 as the technical companion to ISO 27001 closes the most common gap we see in network security audits: strong policy on paper, weak evidence that the network itself was designed and configured to match. The series turns intent into demonstrable engineering, which is the difference between a control that reads well and one that actually holds up.