ASD ISM 0520 Prevent unauthorised network device connections
What it says
Network access controls are implemented on networks to prevent the connection of unauthorised network devices and networked IT equipment.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure only approved devices can connect to the network, blocking unauthorised access.
To keep your network safe, you need to make sure that only devices you trust can connect to it. If you let any unknown or unauthorised devices in, they could bring in viruses or allow people to steal your data, which can damage your reputation and finances.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised devices connecting to the network can bypass protections, enable lateral movement, and lead to data compromise, service disruption, and investigation costs.
How to implement
IT Team: Identify all devices that need to connect to the network, including computers, printers, and phones.
Create a list and ensure each device is approved and known.
System Administrator: Set up network rules to block any device that's not approved from connecting.
Use the network's settings to limit access only to devices on your pre-approved list.
Office Manager: Keep a physical logbook or digital record of all devices authorised to connect.
Check and update this list regularly to ensure only necessary devices have access.
Security Officer: Provide training sessions for employees on how to recognise unauthorised devices and report suspicious activities.
Encourage staff to be vigilant about new or unknown devices.
Procurement Team: Establish a policy requiring all new network-connected devices to be reviewed and approved before purchase.
Ensure that new devices are registered before connecting to the network.
Keep it running
Maintain 802.1X/NAC rules, update allowlists/ACLs for approved devices, and review switch/Wi‑Fi logs and alerts for unauthorised connection attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The device authorisation list: Request to see the list of all devices that are allowed to connect to the network.
Look at
The details to ensure each is current and authorised.
Good evidence
Is a comprehensive list with dates and approval signatures.
- Check 2 of 5What an auditor asks for
Ask for
Network access policy: Request the document outlining the procedures for device connection and approval.
Look at
Clear steps and responsible parties.
Good evidence
Policy will be detailed with recent updates visible.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request documentation of employee training sessions about recognising and reporting unauthorised devices.
Look at
Attendance and topics covered.
Good evidence
Record will have consistent participation and relevant content.
- Check 4 of 5What an auditor asks for
Ask for
Network access logs: Request logs that show which devices have attempted to connect to the network.
Look at
Repeated attempts from unauthorised devices.
Good evidence
Will show monitoring and blocked access for unauthorised devices.
- Check 5 of 5What an auditor asks for
Ask for
To view network access controls: Request a demonstration of how unauthorised devices are blocked.
Look at
The system to ensure it effectively prevents unknown devices.
Good evidence
System actively restricts and logs unauthorised access attempts.
Mappings
Closest match in ISO/IEC 27001: A.8.3, Restrict access to information and assets, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.3.
Annex A 8.3 requires restricting access to information and associated assets according to an access control policy. ISM-0520 supports this by mandating network access controls to prevent unauthorised network devices connecting, thereby limiting who/what can gain network-based access to assets. Annex A 8.3 is broader because it also covers logical access to applications/data and physical access, not only device admission to networks.
This control partially meets A.8.20.
ISM-0520 requires network access controls that block unauthorised network devices from connecting. Annex A 8.20 covers securing, managing and controlling networks and network devices more generally, which includes (but is not limited to) controlling which devices may connect. ISM-0520 is a specific subset of Annex A 8.20 focused on unauthorised device connection prevention rather than the full range of network security controls.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-18.1Isolate systems in criticality- and trust-based network zones with approved, monitored pathwaysPartially overlaps
This control partially overlaps IT.PRO-18.1.
IT.PRO-18.1 requires systems to be isolated in network zones by criticality and trust, with access restricted to approved pathways; ISM-0520 requires network access controls that stop unauthorised network devices and IT equipment connecting, which supports that restriction.
- IT.PRO-18.2Restrict lateral movement between and within segments to approved pathways and servicesPartially overlaps
This control partially overlaps IT.PRO-18.2.
IT.PRO-18.2 requires lateral movement within and between network segments to be limited to approved pathways; ISM-0520 requires network access controls that stop unauthorised network devices and IT equipment connecting, supporting it by controlling what can join the network.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.