Merging Two Networks Under an Existing ISMS
Northwind Logistics has held ISO/IEC 27001 certification since 2021 and is acquiring a regional carrier with 600 staff and 11 depots. The combined estate spans 38 sites, an MPLS core, a new SD-WAN overlay and a legacy flat Layer 2 LAN at the acquired firm. The merger team has been given ISO/IEC 27033-1 and -2 as reference documents and has asked whether the combined network must be 'ISO/IEC 27033 compliant' before the next surveillance audit. The project manager has drafted a 14-workstream plan that treats 27033 as a certification scheme and has not linked any network control to the ISMS risk register. The CISO wants a defensible position for the audit committee in three weeks, including which parts of the 27033 series to use for the interconnection of the two estates and in what order.
1. How should the ISO/IEC 27033 series be positioned relative to ISO/IEC 27001 and ISO/IEC 27002 in this merger? Explain what can and cannot be claimed.
Read the worked answer
ISO/IEC 27001 is the only certifiable requirements standard here; ISO/IEC 27002 gives control guidance, and ISO/IEC 27033 is implementation guidance for network security. The merger should therefore use the ISMS risk assessment (27001 clause 6.1) to decide which network risks need treatment, select control objectives from 27002 (notably 8.20-8.23), and then use 27033 parts to design the technical and procedural detail. The team can claim that the design is 'aligned with' or 'informed by' 27033, but not '27033 compliant' or '27033 certified'. An auditor will test whether risks are identified, controls are implemented and evidence exists, not whether a guidance document was purchased. The audit committee should ask for a traceability matrix: risk -> 27002 control -> 27033 design guidance -> implemented configuration/test evidence. This also prevents the 14 workstreams from becoming a document-production exercise detached from the risk register.
2. Which 27033 parts are most relevant, and in what sequence should the team apply them?
Read the worked answer
Start with Part 1 to establish shared vocabulary: assets, zones, conduits, trust boundaries, security baseline. Then use Part 3 reference scenarios to classify the merger case, especially interconnection of enterprise networks and remote access, and to derive threat/control checklists. Apply Part 2 for the design and implementation process: requirements, logical architecture, physical design, transition and verification. If the estates are joined through a gateway, use Part 4 for gateway control issues; if remote staff or vendors connect, use Part 5 for VPN guidance; use Part 6 only if wireless access is in scope. The sequence matters: risk assessment and target architecture first, product selection later. Part 3 helps challenge the assumption that a flat MPLS/SD-WAN join is acceptable; Part 2 then turns the chosen zones and conduits into a build plan with test criteria. Document which parts were used and why, so the audit committee sees deliberate tailoring rather than a claim of full conformity.
3. A vendor offers an 'ISO/IEC 27033 certified' solution. How should the CISO respond?
Read the worked answer
A vendor cannot be 'ISO/IEC 27033 certified'. 27033 is guidance, not a management system requirements standard, and no accredited certification scheme exists for it. The manager should ask what the vendor actually means: tested against specific 27033-4 gateway control guidance, evaluated under a Common Criteria scheme, or merely designed with reference to the standard. Procurement should restate requirements from the ISMS risk assessment and 27002 controls, then ask for test reports, configuration evidence, patch and vulnerability handling, logging/API support for monitoring, and clear support lifetimes. A demo of features is not evidence of control effectiveness. If the vendor claims certification, request the certificate scope and accreditation body; if none exists, record the claim as marketing and assess the product against the merger's own acceptance criteria. This keeps the audit committee from treating a supplier label as a substitute for risk treatment and verification.