ASD ISM 0629Manage Gateways Between Different Security Domains
Official control statement
For gateways between networks belonging to different security domains, any shared components are managed by system administrators for the higher security domain or by system administrators from a mutually agreed upon third party.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Secure shared network components by assigning management to higher security system admins or a trusted third party.
What this means in practice
When your business uses secure gateways between different networks, like a school connecting to an external education network, the parts these networks share should be managed by someone with a higher security clearance or a trusted outside expert. This matters because it reduces the chance of data breaches or cyber attacks if someone were to exploit these shared points.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2023
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
If shared gateway components between different security domains are not administered by the higher-domain team or an agreed third party, the lower domain may compromise the higher domain.
Operational notes
Ensure any shared gateway components are administered by the higher security domain team or an agreed third party, with documented responsibilities and access controls.
Implementation tips
- Assign a security lead: The business owner or manager should appoint a security lead to oversee the management of gateways. This person could be an internal IT staff member with high security clearance or an external expert like a trusted IT consultancy.
- Engage a trusted third party: If internal expertise is limited, the business manager should contract a professional organisation with a solid reputation in cyber security to manage the network gateways securely.
- Document management procedures: The IT team should create a clear set of procedures for managing the gateways. This document should detail who is responsible, what tasks they must perform, and how often the maintenance and review should occur.
- Regular security trainings: The HR department should organise cyber security training sessions for all staff, emphasising the importance of properly managing network gateways and recognising potential threats.
- Establish a review schedule: The IT lead should schedule regular reviews of gateway management practices, with a detailed checklist to ensure every aspect of security is under control. This helps catch any lapses early on.
Audit / evidence tips
- AskA gateway management policy document: Request the formal document that outlines how gateways between security domains are managedLook atThe assigned responsibilities and procedures detailed within the documentGoodA comprehensive document listing the roles, responsibilities, and protocols clearly outlined
- AskSecurity clearance records: Request records or certificates that prove the security clearance level of those managing the gatewaysLook atThe date of clearance and its alignment with security standardsGoodUp-to-date clearance records of all relevant personnel
- AskTo see the contract with the external security company (if used): If a third-party manages the gateway, request to see the contract or service agreementLook atDefined roles and security standards agreed uponGoodA detailed contract specifying service scope, roles, security benchmarks, and terms
- AskTraining records: Request records of security training sessions mentioned for those involved in managing gatewaysLook atWho attended the training, when it was conducted, and the topics coveredGoodA log showing regular training sessions and updated training materials
- AskMaintenance and review logs: Request logbooks or digital records of maintenance checks on gatewaysLook atConsistent, timely entries that show routine checks and adjustmentsGoodComprehensive logs with regular entries detailing checks and findings
Cross-framework mappings
How ISM-0629 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 8.2 | ISM-0629 requires that shared gateway components between different security domains are managed by administrators from the higher securit... | |
| Annex A 8.20 | ISM-0629 requires that for gateways between different security domains, any shared components are administered by the higher security dom... | |
extensionDepends on(1)expand_less | ||
| Annex A 8.22 | ISM-0629 addresses governance of gateways that connect different security domains by mandating trusted administration of shared gateway c... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Gateways
See all Guidelines for gateways controls, or browse the full ASD ISM library.