ASD ISM 0263 Inspect and decrypt TLS traffic through gateways
What it says
TLS traffic communicated through gateways is decrypted and inspected.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGateways decrypt and check TLS internet traffic for safety reasons.
This control is about making sure the internet traffic that comes into and goes out of your organisation is safe. It does this by temporarily unlocking secure web traffic at a gateway to check for any potential threats, like viruses or hacking attempts. If left unchecked, harmful data can sneak through and cause major damage, like leaking confidential information or disrupting your operations.
Free. Save your status, tasks and notes.
Why it matters
Without TLS decryption and inspection at gateways, malware and data exfiltration can hide in encrypted sessions, bypassing gateway security controls.
How to implement
The IT team should set up a secure gateway to manage internet traffic.
This means selecting a reliable and up-to-date system that can intercept and decrypt the traffic for inspection before it reaches internal systems.
The IT team must configure the gateway to automatically block suspicious or dangerous content.
This involves setting rules for the gateway to identify and stop potential threats, ensuring only safe traffic is allowed through.
A cyber security officer should ensure the gateway is regularly updated.
This means keeping the system patched with the latest security updates to defend against new types of cyber threats.
The IT team should document the process for inspecting and decrypting traffic.
Create clear guidelines that describe how the inspection is done, who oversees it, and what happens if a threat is found.
Managers should conduct regular training for staff to understand the importance of traffic inspection.
This helps all employees recognise how this process protects the organisation and encourages them to report any suspicious activity.
Keep it running
Maintain gateway TLS interception certificates/keys, review SSL bypass/exemption lists, and verify decrypted traffic is logged and inspected for threats.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Gateway configuration documents: Request details on how the gateway is set up to filter internet traffic.
Look at
The presence of rules that identify and block threats.
Good evidence
Would include an updated configuration file with comprehensive rules against different types of threats.
- Check 2 of 5What an auditor asks for
Look at
Timestamps and actions taken on suspicious traffic.
Good evidence
Shows regular activity and appropriate response actions.
- Check 3 of 5What an auditor asks for
Ask for
Them to explain the decryption and inspection process.
Look at
A description of steps taken when a threat is detected.
Good evidence
Would include a well-understood workflow and recent examples of threat mitigation.
- Check 4 of 5What an auditor asks for
Ask for
A demonstration of the gateway filtering traffic.
Look at
How suspicious traffic is handled in real-time.
Good evidence
Shows the gateway actively blocking a test threat.
- Check 5 of 5What an auditor asks for
Look at
Attendance sheets or e-learning completion certificates.
Good evidence
Includes recent training sessions and participation records from all staff.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.20.
ISM-0263 requires gateways to decrypt and inspect TLS traffic traversing them. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include secure proxying, traffic inspection, and appropriate network security controls. ISM-0263 is a specific technique within the broader network security control set described by Annex A 8.20.
This control supports A.8.7.
ISM-0263 requires decrypting and inspecting TLS traffic at gateways so that malicious payloads and unsafe content can be detected in encrypted sessions. Annex A 8.7 requires protection against malware; TLS inspection supports malware protection by enabling web and file scanning, URL filtering, and command-and-control detection that would otherwise be obscured by encryption. Annex A 8.7 covers a wider range of anti-malware controls across endpoints and systems, while ISM-0263 is focused on gateway enforcement for encrypted internet traffic.
This control supports A.8.16.
ISM-0263 requires decryption and inspection of TLS traffic through gateways to enable security visibility into encrypted communications. Annex A 8.16 requires monitoring networks and systems for anomalous behaviour and taking action to evaluate potential incidents; TLS inspection directly improves the fidelity of network monitoring by allowing detection of threats hidden in encrypted flows. Annex A 8.16 is broader (monitoring in general), whereas ISM-0263 is a specific mechanism to make monitoring effective for TLS traffic.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.