ASD ISM 0628 Implementing secure network gateways
What it says
Gateways are implemented between networks belonging to different security domains.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSet up gateways to securely connect networks from different security levels.
This control is about setting up secure gateways when connecting different networks, especially if those networks have different levels of security. Imagine a school network and a public library network needing to talk to each other: if you don't have something to filter and protect the data that passes between them, sensitive information from the school might accidentally be exposed.
Free. Save your status, tasks and notes.
Why it matters
Without gateways between security domains, traffic can bypass boundary controls, enabling unauthorised cross-domain access and sensitive data leakage.
How to implement
Network Administrators should install a gateway device that acts as a secure bridge between networks.
To do this, they need to set up a device like a router or firewall to manage and monitor data traffic carefully, ensuring each network only accesses what it needs.
IT Security Teams should configure the gateway to enforce rules about what data can pass through it.
This involves setting up filters on the gateway to block any unauthorised or suspicious traffic, keeping sensitive information safe.
System Owners should work with IT staff to understand the security requirements of each connected network.
They should review what types of information are shared and the potential risks, ensuring the gateway settings reflect these needs.
Managers should ensure that there is a clear policy in place for managing these gateways.
This includes regular checks and updates by the IT team to keep the gateways functioning properly and accommodating any changes in network security requirements.
Organisation Leaders should involve external security experts to periodically review gateway configurations.
They can do this by hiring consultants or leveraging government resources like the Australian Cyber Security Centre (ACSC) for assessments to ensure best practices are being followed.
Keep it running
Review inter-domain gateway rules (allowlists, routing, filtering/inspection) and validate only approved cross-domain services can traverse the boundary; fix drift promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The gateway configuration documentation: Request detailed records showing how the gateways are set up between networks.
Look at
The rules or policies applied to these gateways.
Good evidence
The document includes rule sets that allow necessary traffic only and block potentially harmful interactions.
- Check 2 of 5What an auditor asks for
Ask for
Logs of data traffic through gateways: Request recent logs that detail data moving through the gateways.
Look at
Patterns and any security incident notes.
Good evidence
Logs show controlled and filtered data flows with no unauthorised access attempts recorded.
- Check 3 of 5What an auditor asks for
Ask for
Incident response records involving gateways: Request records that detail any security incidents involving gateways.
Look at
How quickly incidents were detected and resolved.
Good evidence
There's a clear record showing prompt responses to potential threats and subsequent policy adjustments.
- Check 4 of 5What an auditor asks for
Ask for
Reviews or assessments of gateway configurations: Request reports from any internal or external reviews.
Look at
Changes implemented after these reviews.
Good evidence
Reports suggest robust controls in place, with improvements made based on reviews.
- Check 5 of 5What an auditor asks for
Ask for
Network maps including gateways: Request visual or documented maps showing networks connected by gateways. Look to see that all gateways are accounted for and labelled.
Good evidence
Maps clearly outline network layouts and the placements of each gateway.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-0628 requires gateways between different security domains to enforce controlled and secure traffic flows across domain boundaries. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes secure configuration and operation of boundary devices such as routers, firewalls and gateway appliances. Annex A 8.20 has a wider scope across all network devices and management practices, whereas ISM-0628 is specifically about implementing the inter-domain gateway itself.
This control partially meets A.8.22.
ISM-0628 requires gateways to be implemented between networks belonging to different security domains to control and mediate inter-domain connectivity. ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of services, users and systems within organisational networks, which is commonly implemented using network boundaries and controlled interconnections (including gateways). Annex A 8.22 is broader because it covers internal segregation objectives generally, while ISM-0628 focuses specifically on the gateway control point between distinct security domains.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.