Skip to content
Gateways
ASD ISMISM-0626

ASD ISM 0626 Implementing CDS for secure network segmentation

What it says

CDSs are implemented between SECRET or TOP SECRET networks and any other networks belonging to different security domains.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Cross Domain Solutions connect SECRET or TOP SECRET networks with other networks securely.

This control is about making sure that very sensitive information, like national secrets, is kept safe when systems that manage this data are connected to other networks. If this isn't done properly, confidential information could fall into the wrong hands and cause significant harm to national security or privacy.

Why it matters

Without an approved CDS between SECRET/TOP SECRET and other domains, classified data may leak or be exfiltrated across network boundaries.

How to implement

  1. IT Managers should identify which networks within your organisation need higher security due to sensitive information they handle.

    You can do this by reviewing the types of data each network manages and consulting with your security officer.

  2. IT Teams should implement Cross Domain Solutions, which act like secure gates, between networks dealing with top secret data and other networks.

    This can involve installing specialised systems that ensure only safe and authorised information is shared.

  3. Security Officers should regularly review and update protocols for data exchange between different network domains.

    This means setting clear rules on what kind of information can be shared and verifying that these rules are being followed.

  4. System Administrators should maintain and monitor logs of all data transactions passing through these secure gateways.

    Use security tools to help track and flag any unusual activity, ensuring any suspicious behaviour is immediately addressed.

  5. Policy Makers should ensure that comprehensive training programs are in place for staff who interact with secure networks.

    This training should include understanding the importance of handling sensitive information and the steps required to maintain system integrity.

Keep it running

Operate CDS only at SECRET/TOP SECRET domain boundaries; review transfer rules/allowlists, validate filters, and audit logs for all cross-domain transfers.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The documentation detailing the networks identified as requiring Cross Domain Solutions.

    Look at

    The criteria used for this identification and any risk assessments included.

    Good evidence

    Will include clear justification for each network's classification and a summary of risks.

  2. Check 2 of 5What an auditor asks for

    Ask for

    The configuration documents of the Cross Domain Solutions in place. Look to see that they describe the systems and technologies used, and how they secure data.

    Good evidence

    Shows thorough descriptions and evidence that they match industry guidelines.

  3. Check 3 of 5What an auditor asks for

    Good evidence

    Includes complete logs, analysis of incidents, and resolutions for any issues flagged.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To review the data exchange protocols.

    Look at

    The rules and procedures outlined for safe information transfer between domains.

    Good evidence

    Includes comprehensive, easy-to-understand rules that are regularly reviewed and updated.

  5. Check 5 of 5What an auditor asks for

    Look at

    Attendance records and training content.

    Good evidence

    Will be a detailed account of training sessions, including topics covered and participant feedback.

Mappings

Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.