ASD ISM 0536 Segregate public wireless networks from organisation networks
What it says
Public wireless networks provided for public use are segregated from all other organisation networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure public wireless networks are separate from organisation networks for security.
This control is about keeping your business's internal network separate from the public Wi-Fi you offer visitors. If you don't separate these networks, a hacker using the public Wi-Fi could jump across and access sensitive company information.
Free. Save your status, tasks and notes.
Why it matters
Merging public and private networks risks exposing sensitive company data to unauthorised access, leading to data breaches.
How to implement
The IT team should set up the wireless network: Ensure there's a separate wireless network specifically for staff and another for public use.
This can usually be done by setting up different network names (SSIDs) for each purpose.
Managers should communicate clear usage policies: Make sure staff know which Wi-Fi network to connect to and why it's important.
This helps prevent accidental connections to public networks by employees.
The IT team should use network segmentation tools: Implement tools or hardware that physically and logically separate the networks.
This may involve using different routers or configuring virtual local area networks (VLANs).
HR should provide ongoing training: Regularly educate employees about the risks of using public networks.
Training should include how to identify the correct network and the dangers of using public ones for sensitive work.
The IT team should audit networks regularly: Schedule periodic checks to ensure that the networks remain securely separated.
This can involve testing the network configurations to confirm no crossover.
Keep it running
Regularly review network settings and policies to ensure continued segregation between public and private networks, preventing unauthorised access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
network configuration documentation: Request network setup documents outlining the separation.
Look at
network tables or maps to see if staff and public networks are distinct.
Good evidence
will show separate configurations for each network.
- Check 2 of 5What an auditor asks for
Look at
hardware placements and connections.
Good evidence
setup uses dedicated devices for public and private networks.
- Check 3 of 5What an auditor asks for
Look at
alerts or logs showing attempts to cross from public to private networks.
Good evidence
shows no successful connection attempts between the networks.
- Check 4 of 5What an auditor asks for
Ask for
evidence of staff training sessions: Request attendance records or training materials that cover network separation.
Good evidence
will include dates and content covered in the training.
- Check 5 of 5What an auditor asks for
Look at
policy documents regarding network use: Check the policies provided to staff about which networks to use.
Good evidence
policy clearly instructs staff to use internal networks for work purposes only.
Mappings
Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.22.
ISM-0536 requires that public wireless networks provided for general public use are segregated from all other organisation networks. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation between groups of users, services and systems, which directly includes separating an untrusted public Wi‑Fi segment from internal corporate networks. Annex A 8.22 is broader because it applies to segregation needs across the whole environment (not only public Wi‑Fi), while ISM-0536 is a specific segregation use case.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.