ASD ISM 0535 Prevent VLAN trunk sharing across security domains
What it says
Network devices managing VLANs belonging to different security domains do not share VLAN trunks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure network devices do not use shared paths for VLANs from different security areas.
This control is about keeping computer networks safe by not letting different areas of your business share the same connection paths for their computer traffic. If this isn't done, sensitive information from one part of the business could leak into another, leading to privacy breaches or security incidents.
Free. Save your status, tasks and notes.
Why it matters
If VLAN trunks are shared between security domains, traffic can cross domains via mis-tagging or leaks, causing unauthorised disclosure of sensitive data.
How to implement
The IT team should review the current network design to ensure that VLAN trunks, which are virtual channels used by computers to communicate, aren't shared between different security-sensitive areas.
They can do this by mapping each VLAN and its associated trunk, confirming that data paths are not shared between different departments like finance and HR.
Managers should collaborate with the IT team to understand how their network is set up and ensure it's aligned with security best practices.
Regular meetings can help discuss any changes in business operations that might affect how the network should be configured.
The network administrator should update configuration settings on network devices to ensure VLANs from different departments have separate pathways.
This can be done by logging into network switches and checking that each security domain has its unique trunk.
Procurement officers should ensure that new network equipment supports advanced VLAN features.
They can ask suppliers for specifications that include the ability to separate VLAN traffic securely.
HR should inform the IT team about any significant changes in staff or department structures.
This helps the IT team adjust VLAN assignments and paths to suit the current organisational layout, minimising risks of data leakages.
Keep it running
Verify trunk ports only carry VLANs for a single security domain; remove unused VLANs, restrict allowed VLAN lists, and routinely review switch trunk configs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network topology diagram: Request a visual map showing how the network is laid out and how VLANs are configured.
Look at
Separate paths for each security domain.
Good evidence
Shows clear boundaries between VLANs, with no overlaps between sensitive departments like finance and HR.
- Check 2 of 5What an auditor asks for
Ask for
Device configuration files: Request files from network switches that detail VLAN setups.
Look at
How VLAN trunks are defined and allocated.
Good evidence
Provides configurations indicating that each VLAN trunk is uniquely used per security domain.
- Check 3 of 5What an auditor asks for
Ask for
A change management record: Request records of recent network changes that may affect VLAN paths.
Look at
Documented approvals and rationales behind changes.
Good evidence
Shows that changes were reviewed and authorised, ensuring paths remain separated.
- Check 4 of 5What an auditor asks for
Ask for
To see incident reports related to network issues: Request logs of any past incidents where VLAN configurations may have failed.
Look at
Descriptions of resolved incidents with root cause analysis.
Good evidence
Includes evidence of incidents being fixed without data spills across domains.
- Check 5 of 5What an auditor asks for
Ask for
Documentation on staff training about VLAN security: Request records showing training sessions held for IT and network staff about maintaining VLAN separation.
Look at
Attendance and training content covered.
Good evidence
Shows regular and relevant training, confirming staff are aware of best practices.
Mappings
Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.22.
ISM-0535 requires organisations to prevent VLAN trunks from being shared between VLANs belonging to different security domains, to maintain separation of security areas over the network. This maps to ISO/IEC 27001:2022 Annex A 8.22 because VLAN trunk isolation is a concrete network segregation mechanism used to segregate groups of services, users and systems. Annex A 8.22 is broader (covering segregation by many methods such as routing/ACLs, firewalls, VRFs, physical separation), while ISM-0535 is a specific prohibition focused on trunk sharing across domains.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.