ASD ISM 0345 Disable external interfaces for direct memory access
What it says
External communication interfaces that allow DMA are disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDisable external communication ports that could directly access system memory to prevent unauthorised access.
This control is about turning off certain external connections on your computer that could otherwise directly access its memory. It's important because these connections, if left open, could let someone unauthorised get access to your system and steal or damage sensitive information.
Free. Save your status, tasks and notes.
Why it matters
If DMA-capable interfaces are left enabled, a rogue device can read or alter system memory, enabling credential theft, data exfiltration, or full compromise.
How to implement
The IT team should review and identify all computer systems with external interfaces that allow Direct Memory Access (DMA).
They can do this by checking computer specifications and settings to see which ports and connections are enabled.
System owners should coordinate with the IT team to disable these external interfaces where they're not essential for system operation.
This can be done by using system settings or software tools that manage hardware connections.
IT staff need to update configuration policies to ensure these interfaces stay disabled in future setups or updates.
This involves documenting the changes and integrating them into standard operating procedures.
Managers should educate employees about the importance of not re-enabling these interfaces without prior approval.
This can be set up as part of regular security awareness training sessions.
Procurement officers should include the requirement for disabling DMA-capable interfaces in new hardware purchases.
They should make sure this requirement is clear to vendors when negotiating contracts or placing orders.
Keep it running
Verify DMA-capable ports (e.g., Thunderbolt/PCIe expansion) are disabled in BIOS/UEFI and OS policy, and re-check after firmware updates or hardware changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of systems with disabled DMA interfaces: Request documentation that lists which systems and specific interfaces have been disabled.
Look at
Whether all systems with potential for DMA have been addressed.
Good evidence
Is a complete and regularly updated list approved by the IT team.
- Check 2 of 5What an auditor asks for
Look at
The interface settings in the operating system.
Good evidence
Result shows the relevant interfaces as disabled or not present.
- Check 3 of 5What an auditor asks for
Ask for
How the team ensures these interfaces remain disabled over time.
Good evidence
Include regular checks, monitoring tools used, and clear roles assigned for checking compliance.
- Check 4 of 5What an auditor asks for
Look at
Consistency with training materials and participation logs.
Good evidence
Result is recent, relevant training completed by all staff.
- Check 5 of 5What an auditor asks for
Look at
Whether DMA risk is addressed in procurement criteria.
Good evidence
Includes purchasing guidelines that specify disabling or lack of DMA-capable ports.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.1.
ISM-0345 requires a specific endpoint protection measure: disabling external interfaces that allow DMA to block a direct memory access attack path. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, covering a wide range of endpoint controls (e.g. hardening, encryption, access control, and configuration). ISM-0345 is one concrete technical safeguard that can be implemented to help satisfy the broader endpoint-protection intent of Annex A 8.1.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.