ASD ISM 0496 Use ESP protocol for secure IPsec connections
What it says
The ESP protocol is used for authentication and encryption of IPsec connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishESP protocol is needed to securely encrypt and authenticate IPsec connections.
This control is about using the ESP (Encapsulating Security Payload) protocol to secure communications over the internet. It matters because, without the right protection, your data could be intercepted and read by the wrong people, leading to loss of privacy or exposure of sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without ESP, IPsec traffic may lack encryption/authentication, enabling interception or tampering and exposing sensitive data in transit.
How to implement
The IT team should configure firewalls and routers to use the ESP protocol for all IPsec connections.
This involves accessing the network's hardware settings and specifically enabling ESP, which provides both encryption and data integrity checks.
System administrators need to check that all devices capable of connecting to the network support the ESP protocol.
They should create a checklist of devices and confirm their compatibility with ESP through user manuals or online specifications.
Network managers should regularly update and patch systems to ensure continued compatibility with the latest ESP protocol standards.
Set a reminder to check for updates from vendors and apply them promptly.
IT security officers should conduct training sessions to educate staff on the importance of using secure connections, including how ESP strengthens IPsec.
Use simple scenarios to show how data could be exposed without it.
IT teams should collaborate with external partners to ensure that any third-party connections also utilise the ESP protocol.
This can be done through regular meetings and documentation exchange to verify mutual compliance.
Keep it running
Regularly confirm IPsec tunnels use ESP (not AH) with approved ciphers and integrity checks; review configs after changes and test to detect fallback to insecure settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network configuration documentation: Request detailed settings for firewalls and routers that show ESP is enabled.
Look at
These configurations for specific entries related to ESP in IPsec settings.
Good evidence
Is confirmed settings showing ESP is actively used.
- Check 2 of 5What an auditor asks for
Ask for
A device compatibility list: Request documentation validating each device's support for ESP.
Look at
The list for completeness and check against network inventory.
Good evidence
Is having an up-to-date list showing all network devices supporting ESP.
- Check 3 of 5What an auditor asks for
Ask for
System update schedules: Request documentation of system patch schedules to ensure updates are applied.
Look at
The frequency and execution of these updates related specifically to IPsec and ESP.
Good evidence
Is a regularly maintained schedule with recent completion dates.
- Check 4 of 5What an auditor asks for
Ask for
Training materials: Request copies of materials used in staff training sessions about secure connections.
Look at
The coverage of ESP and IPsec in the lessons.
Good evidence
Is material that explains why and how ESP is used, with attended participant lists.
- Check 5 of 5What an auditor asks for
Ask for
Communications with third-party partners: Request records of agreements or meeting notes regarding the use of ESP in shared systems.
Look at
The documented statements for confirmations of ESP usage.
Good evidence
Is records showing clear, mutual agreement on ESP implementation.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0496 requires the ESP protocol to be used to provide encryption and authentication for IPsec connections. Annex A 8.24 requires an organisation to define and implement rules for the effective use of cryptography and cryptographic key management across the environment. ISM-0496 is a specific technical instantiation of cryptography-in-transit within one protocol suite (IPsec/ESP), whereas Annex A 8.24 is broader and also covers algorithm choices, key lifecycles, and governance beyond IPsec.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.