ASD ISM 0631 Restrict data flows with authorised gateways
What it says
Gateways only allow explicitly authorised data flows.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGateways should block any data transfers not specifically approved.
This control means that any data transfers in your organisation should only happen through pre-approved routes to prevent sensitive information from leaking out. It's like having a secure gate that only opens for visitors you've personally invited. Without this, your confidential data could end up in the wrong hands, leading to privacy breaches and loss of trust from customers and partners.
Free. Save your status, tasks and notes.
Why it matters
If gateways don't restrict data flows to authorised routes, unauthorised transfers can cause data leakage, breaches and loss of trust.
How to implement
The IT team should map out all the data pathways that the business currently uses.
They need to document this by creating a network diagram showing where data enters and leaves the organisation, and note any potential risks. This ensures you know exactly where sensitive information travels.
Managers should decide which data flows are essential.
They can work with the IT team to identify which data transfers are necessary for business operations and which are not. This can be achieved through meetings where business processes are reviewed to determine the essential data flows.
The IT team should configure gateways to restrict data flows.
They should use firewall rules or similar technologies to ensure that only approved data paths are operational, and block all others. This is done by setting up software or hardware that checks the data's 'destination address' and 'sender' before allowing it to pass.
System owners should implement a regular review system for data flow approvals.
They must set up a schedule, perhaps quarterly, to revisit and authorise existing data pathways. This can involve checking logs and reports generated by the gateways to affirm that only authorised paths are used.
The HR team should train staff on the importance of data flow restrictions.
Organise training sessions to ensure that all employees understand why certain data flows are restricted and what to do if they suspect unauthorised transfers. Use real-world scenarios to make the impact relatable.
Keep it running
Regularly review gateway rules/ACLs and the approved data-flow list so only explicitly authorised flows are permitted; remove obsolete paths.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The data flow approval documentation: Request a record of all authorised data flows including who approved them. Look to see that every pathway has a documented business reason and authorising signature.
Good evidence
Is a complete list with dates, reasons, and approvers' details.
- Check 2 of 5What an auditor asks for
Ask for
To see the network diagram: Request to view the organisational data flow map.
Look at
Clear routing paths and annotations of data entry and exit points.
Good evidence
Diagram will show current data pathways with highlighted approved routes.
- Check 3 of 5What an auditor asks for
Ask for
The firewall or gateway configuration report: Request documentation of the firewall rules or gateway settings.
Look at
Detailed rules that correspond to approved data flows and evidence of blocking unauthorised routes.
Good evidence
Includes logs that confirm only the sanctioned data flows are being used.
- Check 4 of 5What an auditor asks for
Ask for
Logs of recent data flow activity: Request logs or reports that show recent data flows through the gateways.
Look at
Anomalies or unauthorised attempts that were successfully blocked.
Good evidence
Shows regular blocking of unauthorised attempts, with time stamps and alerts.
- Check 5 of 5What an auditor asks for
Ask for
About employee awareness programs: Request evidence of recent training sessions on data flow policies.
Look at
Attendance records and training materials that explicitly cover data flow restrictions.
Good evidence
Is a documented training program that notes participant understanding and feedback.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-0631 requires gateways to only allow explicitly authorised data flows and to block all other transfers. This aligns with Annex A 8.20 because securing and controlling networks and network devices commonly includes implementing gateway controls (e.g., firewalls, proxies, secure gateways) that enforce permitted traffic flows. Annex A 8.20 is broader as it covers overall network/device security management beyond authorised flow allow-listing, while ISM-0631 is specific to gateway-enforced data flow authorisation.
This control supports A.8.22.
ISM-0631 requires gateways to enforce explicitly authorised data flows and block all unauthorised transfers. Annex A 8.22 relates by requiring network segregation, which reduces and structures the pathways that gateways must control and makes it practical to define and enforce authorised flows between segments. Annex A 8.22 focuses on segmentation design, whereas ISM-0631 focuses on enforcement at gateways for the flows that traverse boundaries.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.