ASD ISM 0516 Comprehensive network diagrams for critical components
What it says
Network documentation includes high-level network diagrams showing all connections into networks and logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate network diagrams showing connections, critical servers, and security devices for proper documentation.
Creating network diagrams is like drawing a map of how your computers and important equipment are connected. This helps you see where security might be weak and ensures that all important devices are accounted for in case of an incident, preventing potential data breaches or system downtime.
Free. Save your status, tasks and notes.
Why it matters
Without up-to-date high-level and logical network diagrams, critical servers, devices and connections can be missed, delaying response and increasing breach risk.
How to implement
The IT team should create an initial high-level network diagram.
Use simple drawing tools to map out how all the computers, servers, and security tools like firewalls are connected, showing the big picture in general terms.
IT staff should update the logical network diagram regularly.
Every time a new critical server or security device is added or removed, mark it on your detailed network map. This ensures the diagram remains accurate and useful.
Managers should facilitate regular review meetings.
Once every quarter, bring together IT staff and key stakeholders to go through the diagrams and identify any changes or risks. This helps maintain alignment across departments.
Business owners should allocate resources for detailed network documentation.
Encourage investing in tools or software that make diagramming easier and more comprehensive, improving clarity and accessibility.
Managers should ensure secure storage of network diagrams.
Print or save these diagrams in a secure but easily accessible format in a centralised location to protect the information while ensuring that it's available when needed.
Keep it running
Update high-level ingress/egress and logical diagrams after changes; include all critical/high-value servers, network devices and security appliances.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The most recent network diagrams: Request both the high-level and detailed logical network diagrams.
Look at
The dates on the diagrams to ensure they're recent.
Good evidence
Is diagrams updated within the last three months.
- Check 2 of 5What an auditor asks for
Ask for
Documentation of changes: Request records of updates or changes to the network.
Look at
Entries in a change log detailing what changes were made and why.
Good evidence
Shows consistent updates reflecting recent network alterations.
- Check 3 of 5What an auditor asks for
Ask for
How diagrams are reviewed: Inquire about the process for regular diagram reviews.
Look at
Evidence of scheduled meetings or review processes.
Good evidence
Includes meeting minutes or notes demonstrating regular reviews.
- Check 4 of 5What an auditor asks for
Ask for
Access controls on diagrams: Request information about who can view and edit the network diagrams.
Look at
Permission settings ensuring only authorised personnel have access.
Good evidence
Includes a list of authorised users and their roles.
- Check 5 of 5What an auditor asks for
Ask for
About storage solutions: Inquire where the diagrams are kept.
Look at
The storage system or location for security measures protecting this data.
Good evidence
Involves secure digital storage with backup protocols in place.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-0516 requires organisations to maintain comprehensive network diagrams that show inbound/outbound connections and the placement of critical servers and security appliances. Annex A 8.20 focuses on securing, managing and controlling networks and network devices, and accurate diagrams from ISM-0516 support this by enabling correct identification of network boundaries, device roles, and security control points. Annex A 8.20 is about technical and operational security of networks, whereas ISM-0516 is about documentation that facilitates those activities.
This control depends on A.8.9.
ISM-0516 requires network documentation to include high-level and logical network diagrams showing all connections and all critical components (e.g. critical servers and security appliances). Annex A 8.9 requires configurations of networks and related components to be established and documented, which is strengthened by having accurate network diagrams as part of the documented network configuration baseline. Annex A 8.9 is broader (covering the full configuration management lifecycle), while ISM-0516 is specifically about diagrammatic network documentation for critical components.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.