ASD ISM 0494 Use of IPsec tunnel and transport modes
What it says
Tunnel mode is used for IPsec connections; however, if using transport mode, an IP tunnel is used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIPsec connections should use tunnel mode; if using transport mode, ensure an IP tunnel is used.
This control is about using a specific method to secure information when it's sent over the internet-like putting it in a secure envelope. Tunnel mode is preferred because it wraps everything up securely. If you don't use it, private information could be exposed, leading to data leaks or breaches.
Free. Save your status, tasks and notes.
Why it matters
Using IPsec transport mode without an IP tunnel can expose payload data and leak endpoints, increasing interception risk and causing compliance issues.
How to implement
IT team should configure network devices to use IPsec tunnel mode for site-to-site communication.
This can be done by accessing the device settings and selecting 'tunnel mode' under the IPsec settings to ensure all data is encrypted and both sender and receiver information are hidden.
System administrators should review current IPsec configurations regularly to ensure they are in tunnel mode.
They can do this by logging into the systems and checking the network configuration section specifically for IPsec settings.
IT security personnel should create a checklist to verify that all virtual private network (VPN) connections use IPsec tunnel mode.
Use network management tools to scan and report back on the status of each connection.
Network operations should plan and conduct training sessions for staff responsible for maintaining IPsec configurations.
This involves setting up workshops where practical demonstrations on how to implement and verify settings are conducted.
Project managers should integrate IPsec tunnel mode checks into new project start-ups that require data transmission over the internet.
This involves liaising with IT to ensure that any data movement planned adheres to the tunnel mode use, documented during project initiation.
Keep it running
Confirm IPsec uses tunnel mode by default; if transport mode is required, ensure an IP tunnel is configured and periodically validate settings in change reviews.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network configuration policy document: Request to see the organisation's protocol for setting up IPsec connections.
Look at
The sections specifying IPsec operation modes.
Good evidence
Policy will explicitly require tunnel mode as the default setting.
- Check 2 of 5What an auditor asks for
Ask for
The document detailing the findings of recent IPsec tunnel mode checks.
Look at
Notes on compliance, exceptions, and follow-up actions.
Good evidence
Report will show a high compliance rate with noted exceptions being addressed.
- Check 3 of 5What an auditor asks for
Ask for
Training records of the IT staff: Request certificates or attendance records from IPsec configuration training sessions.
Look at
Participant lists and session content. Good records will show relevant and recent training for all key staff.
- Check 4 of 5What an auditor asks for
Ask for
To see logs of any network configuration changes involving IPsec.
Look at
Entries confirming the switch to or validation of tunnel mode. A strong answer will show recent and well-documented changes with responsible parties identified.
- Check 5 of 5What an auditor asks for
Ask for
System status dashboards: Request access or screenshots of network monitoring tools displaying IPsec configurations.
Look at
The real-time or recent records of IPsec status.
Good evidence
Dashboard confirms that connections are consistently in tunnel mode.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-0494 requires organisations to use IPsec tunnel mode for IPsec connections, and if transport mode is used, to implement an IP tunnel to preserve appropriate security properties. This relates to Annex A 8.20 because securing and controlling networks and network devices includes selecting and enforcing secure network encryption and tunnelling methods for inter-network connectivity (e.g. VPN architectures). Annex A 8.20 is broader and technology-agnostic as it covers many network security controls, while ISM-0494 is a specific prescriptive requirement about IPsec mode selection and tunnelling.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.