ASD ISM 0626 Implementing CDS for secure network segmentation
What it says
CDSs are implemented between SECRET or TOP SECRET networks and any other networks belonging to different security domains.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCross Domain Solutions connect SECRET or TOP SECRET networks with other networks securely.
This control is about making sure that very sensitive information, like national secrets, is kept safe when systems that manage this data are connected to other networks. If this isn't done properly, confidential information could fall into the wrong hands and cause significant harm to national security or privacy.
Free. Save your status, tasks and notes.
Why it matters
Without an approved CDS between SECRET/TOP SECRET and other domains, classified data may leak or be exfiltrated across network boundaries.
How to implement
IT Managers should identify which networks within your organisation need higher security due to sensitive information they handle.
You can do this by reviewing the types of data each network manages and consulting with your security officer.
IT Teams should implement Cross Domain Solutions, which act like secure gates, between networks dealing with top secret data and other networks.
This can involve installing specialised systems that ensure only safe and authorised information is shared.
Security Officers should regularly review and update protocols for data exchange between different network domains.
This means setting clear rules on what kind of information can be shared and verifying that these rules are being followed.
System Administrators should maintain and monitor logs of all data transactions passing through these secure gateways.
Use security tools to help track and flag any unusual activity, ensuring any suspicious behaviour is immediately addressed.
Policy Makers should ensure that comprehensive training programs are in place for staff who interact with secure networks.
This training should include understanding the importance of handling sensitive information and the steps required to maintain system integrity.
Keep it running
Operate CDS only at SECRET/TOP SECRET domain boundaries; review transfer rules/allowlists, validate filters, and audit logs for all cross-domain transfers.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documentation detailing the networks identified as requiring Cross Domain Solutions.
Look at
The criteria used for this identification and any risk assessments included.
Good evidence
Will include clear justification for each network's classification and a summary of risks.
- Check 2 of 5What an auditor asks for
Ask for
The configuration documents of the Cross Domain Solutions in place. Look to see that they describe the systems and technologies used, and how they secure data.
Good evidence
Shows thorough descriptions and evidence that they match industry guidelines.
- Check 3 of 5What an auditor asks for
Good evidence
Includes complete logs, analysis of incidents, and resolutions for any issues flagged.
- Check 4 of 5What an auditor asks for
Ask for
To review the data exchange protocols.
Look at
The rules and procedures outlined for safe information transfer between domains.
Good evidence
Includes comprehensive, easy-to-understand rules that are regularly reviewed and updated.
- Check 5 of 5What an auditor asks for
Look at
Attendance records and training content.
Good evidence
Will be a detailed account of training sessions, including topics covered and participant feedback.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.14.
ISM-0626 mandates the use of CDSs to manage cross-domain connectivity between SECRET or TOP SECRET networks and other domains. ISO/IEC 27001:2022 Annex A 5.14 requires documented procedures for information transfer, which CDSs technically enforce (filtering, inspection, controlled release). Annex A 5.14 focuses on procedural requirements while ISM-0626 provides a specific technical solution for high-classification cross-domain transfers.
This control partially meets A.8.22.
ISM-0626 requires organisations to implement Cross Domain Solutions (CDSs) between SECRET or TOP SECRET networks and any other networks in different security domains. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation of groups of services, users, and systems. This broader design objective encompasses the type of segmentation enforced by CDSs for high-side networks. ISM-0626 is more specific due to its focus on higher classifications (SECRET/TOP SECRET) and cross-domain connections, whereas Annex A 8.22 applies more generally to various network environments.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.




