ASD ISM 0643 Use of diodes for unidirectional gateway security
What it says
Evaluated diodes are used for controlling the data flow of unidirectional gateways between an organisation's networks and public network infrastructure.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse special devices (diodes) to ensure data flows one way only between networks, enhancing security.
This control is about using diodes to make sure information only flows in one direction between your private network and the public internet. This is important because if data can flow both ways, a hacker could potentially gain access to sensitive information or disrupt your operations.
Free. Save your status, tasks and notes.
Why it matters
Without diodes, bidirectional flows can let attackers exfiltrate sensitive data or inject malicious traffic into secure networks.
How to implement
The IT manager should research and select the appropriate diodes for their network.
This involves reviewing security needs and consulting with trusted vendors to find the diode device that best supports one-way data flow for your current setup.
System administrators should install the diode devices between the internal network and the public network.
This process involves physically connecting the diode to the network paths, ensuring data can only travel outwards but not return to the sensitive internal systems.
The IT security team should configure network settings to support the diode operation.
This means adjusting firewall rules and monitoring systems to support and verify that no data can flow into the network through alternate paths.
IT staff should regularly test the functionality of the diodes.
This can be done by simulating data transfer attempts from the public network toward the private network and ensuring these attempts are blocked.
Managers should organise training for staff on the importance of unidirectional data flow.
This includes awareness of why the diode is in place and how staff actions can help maintain secure communication practices.
Keep it running
Regularly verify diode configuration and review flow logs to confirm unidirectional data transfer integrity.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The procurement records of diode devices: Request to see purchase orders and invoices related to the diodes installed.
Look at
The details to confirm that the devices match the intended specifications for unidirectional data flow.
Good evidence
Includes documentation showing purchase specifics and alignment with system requirements.
- Check 2 of 5What an auditor asks for
Ask for
A network diagram showing diode placement: Review diagrams that outline the network setup and diode locations.
Look at
Clear indications that diodes are installed between designated network segments.
Good evidence
Shows up-to-date diagrams with clear annotations for each diode.
- Check 3 of 5What an auditor asks for
Ask for
Configuration settings of installed diodes: Request system logs or screenshots showing current settings.
Look at
Settings that enforce unidirectional data transfers.
Good evidence
Shows secure configurations consistent with manufacturer and security guidance.
- Check 4 of 5What an auditor asks for
Ask for
Test reports on diode operation effectiveness: Request records of any tests conducted to verify diode performance.
Look at
The test procedures and results for evidence of blocked incoming data attempts.
Good evidence
Includes comprehensive test results confirming expected diode performance.
- Check 5 of 5What an auditor asks for
Ask for
Training records on diode usage: Request documentation of any staff training sessions about the diode's purpose and operation.
Look at
Attendance records and training materials.
Good evidence
Includes recent training records and feedback indicating increased staff understanding.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.14.
ISM-0643 requires evaluated diodes to control data flow in unidirectional gateways between internal networks and public network infrastructure. ISO/IEC 27001:2022 Annex A 5.14 requires information transfer rules and procedures for transfer facilities, and a diode-enforced one-way gateway is a technical enforcement mechanism that can underpin those transfer rules (e.g. only outbound telemetry/log export). Annex A 5.14 is policy/procedure focused across many transfer methods, while ISM-0643 is a specific boundary technology control.
This control partially meets A.8.20.
ISM-0643 requires organisations to use evaluated diodes to enforce one-way data flow in unidirectional gateways between internal networks and public network infrastructure. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include implementing one-way gateways/diodes as a network-device security mechanism for high-assurance boundary protection. ISM-0643 is a specific, technology-prescriptive control for a particular gateway pattern, while Annex A 8.20 is broader and allows many alternative network security controls.
This control partially meets A.8.22.
ISM-0643 requires evaluated diodes to enforce one-way data flow at a unidirectional gateway between organisational networks and public network infrastructure. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation of services, users and systems, and a unidirectional gateway implemented with a diode is a strong segregation mechanism to prevent reverse-path data movement. Annex A 8.22 is about segmentation design broadly, whereas ISM-0643 focuses specifically on assuring unidirectionality rather than general segregation across the enterprise network.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.