ASD ISM 0622 Ensuring network authentication via gateways
What it says
IT equipment authenticates to other networks accessed via gateways.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIT devices must prove their identity to access networks through gateways.
This control ensures that any IT devices trying to access your network through a gateway must first prove their identity. It's crucial because if unauthorised devices can connect to your network without verification, they could steal data or cause harm.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised devices authenticating through gateways can bypass access controls, enabling data exfiltration, malware entry and service disruption.
How to implement
The IT team should set up authentication gateways: Make sure that any device connecting to your network goes through a system that checks its identity.
This might involve configuring routers or other network devices to require a login or device certificate before allowing access.
Managers should conduct training sessions: Educate staff about the importance of network security and the role gateways play in protecting the organisation.
Explain how devices are authenticated and why they should report any issues or anomalies to the IT team immediately.
The system owner should regularly review access logs: Check the records of which devices have connected to the network through the gateways to identify any unauthorised access attempts.
Set a schedule to review these logs weekly.
Procurement should ensure devices are compatible with authentication standards: When acquiring new IT equipment, confirm that they support the necessary authentication protocols with your gateways.
Work closely with the IT team to identify suitable specifications.
The IT team should regularly update authentication software: Keep the authentication systems up-to-date to defend against the latest threats.
This might involve applying software patches or upgrades as soon as they're available.
Keep it running
Enforce mutual authentication for devices crossing gateways (e.g., 802.1X/certificates), and review gateway auth logs for failed or unknown devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The device authentication policy document: Request a copy of the procedures that outline how devices are authenticated when accessing the network via gateways.
Look at
Clear guidelines on who is responsible for setting up and maintaining these systems.
Good evidence
Includes a dated policy with named responsible roles and review dates.
- Check 2 of 5What an auditor asks for
Ask for
To see the access logs for gateway connections: Request logs that document device connections through your gateways over the past month.
Look at
Whether each entry includes a device identifier and a success/failure result.
Good evidence
Shows detailed logs with timestamps and proper device identification.
- Check 3 of 5What an auditor asks for
Ask for
Recent training records: Request evidence of staff training sessions related to network security and device authentication.
Look at
Attendance lists and training materials.
Good evidence
Is a record of recent sessions including attendance and outlined agenda points.
- Check 4 of 5What an auditor asks for
Ask for
A list of compatible devices: Request an inventory of devices currently authorised to access your network.
Look at
Documentation of compatibility checks against your authentication systems.
Good evidence
Is a complete, up-to-date list with compatibility confirmation.
- Check 5 of 5What an auditor asks for
Ask for
System maintenance records: Request logs or documents detailing updates and patches to authentication systems.
Look at
The frequency of updates and any noted system issues.
Good evidence
Shows evidence of regular updates and resolutions to any identified issues.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
ISM-0622 requires IT equipment to prove its identity to networks reached through gateways, which is a specific logical access control requirement for inter-network access. Annex A 5.15 establishes rules and procedures to control physical and logical access to information assets, under which device authentication at gateways is a concrete implementation. Annex A 5.15 is broader because it covers policy and procedures for access control across all assets and access methods, not only device-to-network authentication through gateways.
This control partially meets A.8.3.
ISM-0622 requires IT equipment authentication to other networks accessed via gateways, ensuring only identified devices can traverse the gateway into another network. Annex A 8.3 requires restricting access to information and assets in line with access control policy, which can be achieved in part by authenticating devices before permitting network connectivity. Annex A 8.3 is broader because it covers access restriction outcomes for information and assets generally, whereas ISM-0622 is focused on device authentication for network access via gateways.
This control partially meets A.8.5.
ISM-0622 requires IT equipment to authenticate when accessing other networks via gateways, addressing authentication at network boundaries. Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions, which can include device authentication mechanisms (e.g. 802.1X, mutual TLS, VPN client certificates) used at gateways and network access points. Annex A 8.5 is broader because it applies to authentication generally (users, devices and systems) across many access scenarios, not specifically gateway-mediated network access.
This control partially meets A.8.20.
ISM-0622 requires IT equipment to authenticate to other networks that are accessed via gateways, focusing on device-to-network identity assurance at trust boundaries. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which commonly includes enforcing authenticated access between network segments and at gateways. Annex A 8.20 is broader because it covers the full range of network security management (configuration, monitoring, administration and controls), not just authentication of IT equipment traversing gateways.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.