ASD ISM 0518 Maintain comprehensive network documentation
What it says
Network documentation is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that network documentation is regularly created, updated, and kept available to support network management.
Network documentation involves keeping a clear and updated record of your organisation's network setup. This is important because it helps your IT team manage and troubleshoot the network efficiently, ensuring your business runs smoothly and securely. Without it, you risk outages and security issues that can disrupt your operations and potentially expose sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Outdated or missing network documentation delays fault isolation, increases misconfiguration risk and can enable unauthorised access or data exposure during changes and outages.
How to implement
System owners should appoint a dedicated person or team to oversee network documentation.
They should regularly update records to reflect any changes, like new devices or software installed on the network. This ensures the documentation remains accurate and useful for ongoing management.
The IT team should create a detailed map of the network.
This includes identifying all devices connected, such as computers, routers, and switches, and noting how they are connected. Use diagrams or software tools that can easily be updated to reflect changes.
Managers should schedule regular reviews of the network documentation.
Every few months, arrange a meeting with the IT team to go over the documents and verify that they are up-to-date. This helps catch any discrepancies before they become issues.
Procurement should coordinate with the IT team to ensure that any new purchases, like hardware or software, are documented immediately.
This means noting the device specifications, location on the network, and purpose. This way, new elements are integrated smoothly into the existing network structure.
The office manager should maintain a centralised location, like a secure online folder or binder, where all network documentation is stored.
This ensures it is easily accessible to those who need it, providing a reliable reference point in case of network issues.
Keep it running
Maintain current network diagrams, IP ranges, VLANs, routing and config baselines; update immediately after changes and reconcile documentation against device configs regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current network diagram: Request a copy of the diagram outlining all network connections and devices.
Look at
Clear labels on all devices and connections, and check for recent updates indicated by dates.
Good evidence
The diagram is detailed, up-to-date within the last three months, and accessible to the IT team.
- Check 2 of 5What an auditor asks for
Ask for
To view the network device inventory list: Request the document listing all devices connected to the network, along with their details.
Look at
The device types, locations, and any recent changes reflected.
Good evidence
The inventory is complete, regularly updated, and matches the network diagram.
- Check 3 of 5What an auditor asks for
Ask for
Records of network documentation review meetings: Request past meeting notes or agendas focusing on network documentation.
Look at
Details on what was reviewed and any actions taken.
Good evidence
Meeting records showing reviews were conducted at least quarterly with clear action items noted.
- Check 4 of 5What an auditor asks for
Ask for
Examples of documentation updates: Request recent updates or change logs to the network documentation.
Look at
The dates of changes and the reasons recorded for each update.
Good evidence
Change logs show clear documentation updates corresponding with network modifications, with dates and reasons.
- Check 5 of 5What an auditor asks for
Ask for
To access the centralised documentation storage system: Request access to the secure repository where network documents are stored and managed.
Look at
How the documents are organised and how access is controlled.
Good evidence
The storage is secure, easily navigable, and access is restricted to authorised personnel.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.9.
ISM-0518 requires organisations to keep network documentation current and available. Annex A 8.9 requires configurations of hardware, software, services and networks to be established, documented, implemented, monitored and reviewed, and network documentation from ISM-0518 provides the baseline context (topology, interfaces, dependencies) needed to document and review network configurations. Annex A 8.9 is broader because it mandates configuration controls and monitoring beyond documentation alone.
This control depends on A.8.20.
ISM-0518 requires organisations to develop, implement and maintain network documentation to support effective network management. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which is strengthened by accurate network diagrams, device inventories, data flows and interconnection records maintained under ISM-0518. The ISO control focuses on security outcomes and controls, while ISM-0518 focuses on the documentation artifacts that enable those outcomes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.