ASD ISM 0534 Disable unused network device ports
What it says
Unused physical ports on network devices are disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNetwork devices should have any unused physical ports turned off to prevent unauthorised access.
This control means turning off any network ports that aren't being used in your organisation's devices, like routers or switches. It matters because if these ports are left on, someone could plug in and access your network without permission, which could lead to sensitive data being stolen or your systems being hacked.
Free. Save your status, tasks and notes.
Why it matters
Leaving unused ports active can allow unauthorised network access, enabling rogue device connection, lateral movement and potential data breaches.
How to implement
IT team: Identify all network devices in your organisation such as switches and routers that might have unused ports.
Do this by conducting a physical walk-through of your network infrastructure and checking the port status on network device management interfaces.
IT manager: Create a policy to regularly check and disable unused ports on all network devices.
Draft a standard procedure that involves routinely generating a list of active and inactive ports from network management software.
System administrator: Disable unused ports by accessing network device management settings.
Use the device's user interface to manually turn off any ports that aren't in use, following the vendor's guidelines.
Network security officer: Set up alerts for when new devices are connected to any network port.
Use your network management tools to configure alerts which notify you by email or app when unexpected devices are connected.
IT support team: Train staff to recognise the importance of keeping unused ports disabled.
Develop a quick training session or reminder guides, outlining how to inform IT when a port is no longer required, and what steps to take if they see someone using an unallocated port.
Keep it running
Regularly audit switch/router physical ports and administratively shut unused ones; alert on port state changes to detect unauthorised connections quickly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Network port status reports: Request reports showing the current status of each port on network devices.
Look at
Whether there are entries indicating any ports are inactive or have been formally disabled by the IT team.
Good evidence
Is seeing a majority of ports marked as 'inactive' or 'disabled' along with recent audit dates.
- Check 2 of 5What an auditor asks for
Ask for
To see the device management procedure document: This should outline steps on checking and disabling ports.
Look at
Whether the document is up-to-date and includes responsibilities and frequency for checks.
Good evidence
Includes detailed, current procedures that match the actual setup and practices.
- Check 3 of 5What an auditor asks for
Ask for
Training schedules or records: Request documented evidence of staff training on unused port policies.
Look at
Participation records or signed acknowledgements from team members after training sessions.
Good evidence
Is seeing regular training dates and broad staff understanding of port security.
- Check 4 of 5What an auditor asks for
Ask for
To view automated alert configurations: Request a demo of the alert system for unauthorised port usage.
Look at
Whether it is actually set up to notify the necessary personnel and test alerts.
Good evidence
Includes seeing real-time alerts function correctly during testing.
- Check 5 of 5What an auditor asks for
Ask for
A recent audit report on network devices: Request an internal or third-party audit report highlighting port usage.
Look at
Findings or recommendations about port management.
Good evidence
Contains no critical findings on open, unauthorised ports.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
Annex A 8.20 requires network devices to be secured and controlled to prevent unauthorised access to information and services. ISM-0534 relates by requiring unused physical ports on network devices to be disabled, reducing attack surface and preventing unauthorised connectivity. Annex A 8.20 is broader because it includes many other device and network security controls beyond physical port state management.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.