ASD ISM 0385 Maintain effective functional separation between servers

Each server should perform its own distinct function and not share a machine or operating environment with unrelated server roles. Keeping server functions separate means that if one server is compromised, overloaded or fails, the problem stays contained and does not automatically spread to other services. This control is about the design choice to host different roles (for example a web server, a database server and an email server) on separate servers rather than bundling them together.

Think of each server as a separate room with its own locked door, rather than running everything in one big open space. When the email service, the website and the customer database each live on their own server, a break-in or breakdown in one is much less likely to knock over the others. If everything runs together on a single server, one weakness gives an attacker access to all of it at once, and one crash can take down everything. "Functional separation" simply means giving each major job its own server, so an issue in one place does not become an issue everywhere.