ASD ISM 0616 Ensure separation of duties for gateway admins
What it says
Separation of duties is implemented in performing administrative activities for gateways.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDifferent people handle administrative tasks for gateways to reduce security risks.
Separating duties for those who manage the gateways of a network means different people handle different tasks to reduce risks. This is important because if one person controls everything, they could make a mistake or do something harmful, putting the whole network at risk.
Free. Save your status, tasks and notes.
Why it matters
Without separation of duties for gateway admins, a single error or malicious act could change gateway rules and expose the network to unauthorised access.
How to implement
Managers should assign different tasks to different people within the IT team for managing gateways.
Clearly define roles such as monitoring, update management, and access control to separate responsibilities effectively. Make sure each person knows their specific duties and who they need to report to.
The IT team should establish clear procedures for each gateway management task.
Define detailed steps for tasks like updating software, managing user access, and monitoring activity. Document these procedures in a 'Gateway Management Handbook' for consistency and clarity.
An IT manager should perform a regular review of the assigned roles and tasks.
Schedule quarterly check-ins to discuss roles and assess if any changes or updates are required due to shifts in personnel or technology. Document any changes and circulate them to the team.
Human Resources should ensure that all new IT team members receive training on the importance of separated duties.
Include an introductory session on their specific responsibilities when managing gateways, using real-life examples to illustrate the risks of not following procedures.
The cyber security coordinator should implement checks and balances for each gateway task.
Design specific oversight processes, like audits and peer reviews, to catch mistakes or malicious activities early. Conduct these checks according to a set schedule and revise them if necessary.
Keep it running
Define distinct gateway admin tasks (e.g., rule changes vs approval), enforce dual approval for changes, and review role assignments regularly to prevent overlap.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of personnel assigned to gateway management tasks: Request documentation that lists who is responsible for each specific task.
Look at
Whether different individuals are assigned to competing tasks.
Good evidence
Distinct names and clear task delineation per person.
- Check 2 of 5What an auditor asks for
Look at
Detailed task procedures relating to updates, monitoring, and access control.
Good evidence
Procedures are comprehensive, regularly updated, and accessible to all relevant team members.
- Check 3 of 5What an auditor asks for
Ask for
Records of quarterly role review meetings: Request minutes or notes from these meetings.
Look at
Evidence of role assessment and any adjustments made with reasons.
Good evidence
Documented discussions and decisions, with date and attendees listed.
- Check 4 of 5What an auditor asks for
Look at
The curriculum for modules on separation of duties.
Good evidence
Documents include practical examples and outline specific responsibilities for new team members.
- Check 5 of 5What an auditor asks for
Ask for
Records of gateway task audits or peer reviews: Request reports from recent reviews.
Look at
Evidence of checks and any findings or adjustments made.
Good evidence
Detailed review notes with issues identified and corrective actions taken.
Mappings
Closest match in ISO/IEC 27001: A.5.3, Segregation of duties, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.3.
ISM-0616 requires separation of duties when performing administrative activities for gateways, so that no single administrator controls all gateway functions. This is a specific application of Annex A 5.3, which requires conflicting duties and conflicting areas of responsibility to be segregated. Annex A 5.3 applies across the whole organisation, while ISM-0616 is limited to gateway administration.
This control partially meets A.8.2.
ISM-0616 requires separation of duties for gateway administrative activities, dividing administrative functions between different personnel. Dividing these duties restricts the privileged access rights each gateway administrator holds, which directly supports the restriction and management of privileged access rights required by Annex A 8.2. Annex A 8.2 covers the allocation and use of privileged access across all systems, while ISM-0616 addresses only how gateway administrative duties are split.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.