ASD ISM 0629 Manage gateways between different security domains
What it says
For gateways between networks belonging to different security domains, any shared components are managed by system administrators for the higher security domain or by system administrators from a mutually agreed upon third party.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSecure shared network components by assigning management to higher security system admins or a trusted third party.
When your business uses secure gateways between different networks, like a school connecting to an external education network, the parts these networks share should be managed by someone with a higher security clearance or a trusted outside expert. This matters because it reduces the chance of data breaches or cyber attacks if someone were to exploit these shared points.
Free. Save your status, tasks and notes.
Why it matters
If shared gateway components between different security domains are not administered by the higher-domain team or an agreed third party, the lower domain may compromise the higher domain.
How to implement
Assign a security lead: The business owner or manager should appoint a security lead to oversee the management of gateways.
This person could be an internal IT staff member with high security clearance or an external expert like a trusted IT consultancy.
Engage a trusted third party: If internal expertise is limited, the business manager should contract a professional organisation with a solid reputation in cyber security to manage the network gateways securely.
Document management procedures: The IT team should create a clear set of procedures for managing the gateways.
This document should detail who is responsible, what tasks they must perform, and how often the maintenance and review should occur.
Regular security trainings: The HR department should organise cyber security training sessions for all staff, emphasising the importance of properly managing network gateways and recognising potential threats.
Establish a review schedule: The IT lead should schedule regular reviews of gateway management practices, with a detailed checklist to ensure every aspect of security is under control.
This helps catch any lapses early on.
Keep it running
Ensure any shared gateway components are administered by the higher security domain team or an agreed third party, with documented responsibilities and access controls.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A gateway management policy document: Request the formal document that outlines how gateways between security domains are managed.
Look at
The assigned responsibilities and procedures detailed within the document.
Good evidence
A comprehensive document listing the roles, responsibilities, and protocols clearly outlined.
- Check 2 of 5What an auditor asks for
Ask for
Security clearance records: Request records or certificates that prove the security clearance level of those managing the gateways.
Look at
The date of clearance and its alignment with security standards.
Good evidence
Up-to-date clearance records of all relevant personnel.
- Check 3 of 5What an auditor asks for
Ask for
To see the contract with the external security company (if used): If a third-party manages the gateway, request to see the contract or service agreement.
Look at
Defined roles and security standards agreed upon.
Good evidence
A detailed contract specifying service scope, roles, security benchmarks, and terms.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request records of security training sessions mentioned for those involved in managing gateways.
Look at
Who attended the training, when it was conducted, and the topics covered.
Good evidence
A log showing regular training sessions and updated training materials.
- Check 5 of 5What an auditor asks for
Ask for
Maintenance and review logs: Request logbooks or digital records of maintenance checks on gateways.
Look at
Consistent, timely entries that show routine checks and adjustments.
Good evidence
Comprehensive logs with regular entries detailing checks and findings.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.2.
ISM-0629 requires that shared gateway components between different security domains are managed by administrators from the higher security domain or an agreed third party. Annex A 8.2 requires privileged access rights to be restricted and managed, which is directly relevant to controlling who can administer gateway infrastructure spanning domains. Annex A 8.2 is about managing privileged access generally, while ISM-0629 is a specific assignment of administrative control for cross-domain gateway shared components.
This control partially meets A.8.20.
ISM-0629 requires that for gateways between different security domains, any shared components are administered by the higher security domain's administrators or an agreed trusted third party. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes secure administration and governance of devices such as domain gateways. Annex A 8.20 is broader across all network devices, while ISM-0629 is a specific governance rule about who manages shared gateway components between domains.
This control depends on A.8.22.
ISM-0629 addresses governance of gateways that connect different security domains by mandating trusted administration of shared gateway components. Annex A 8.22 requires network segregation, which commonly creates and relies on controlled gateways between segregated zones or domains. Annex A 8.22 focuses on segmentation design, whereas ISM-0629 focuses on administrative ownership/trust for the shared gateway components that enforce that segregation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.