ASD ISM 0705 Disable split tunnelling for VPN connections
What it says
When accessing an organisation's network via a VPN connection, split tunnelling is disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that devices accessing the organisation's network through VPN do not use split tunnelling for security.
This control is about turning off a feature called 'split tunnelling' on Virtual Private Network (VPN) connections. If devices use split tunnelling, they can access the internet directly while also being on your company's network, which makes it easier for hackers to sneak in without being noticed. Disabling split tunnelling forces all internet traffic to go through the secure company network, which reduces the risk of cyber attacks.
Free. Save your status, tasks and notes.
Why it matters
Allowing split tunnelling on VPNs can expose sensitive data and enable attacks via the user's unsecured internet path while connected to the corporate network.
How to implement
The IT team should review the VPN settings for all devices accessing the company network.
This involves checking each device's VPN configuration to ensure split tunnelling is disabled, meaning all data is routed through the company's secure connection.
The IT manager should update company policies regarding VPN use.
These policies should clearly state that split tunnelling is not allowed, and ensure that all staff who use VPNs are aware of this requirement.
Network administrators need to configure the VPN server to prevent split tunnelling.
They can do this by setting up routing rules that force all traffic through the VPN, effectively blocking split tunnelling capabilities.
Staff training coordinators should ensure employees understand the importance of not using split tunnelling.
This can include training sessions or informational documents explaining the security risks and how to use the VPN properly.
The IT support team should regularly monitor network traffic for any signs of split tunnelling.
They can use network logs to check that all traffic is going through the VPN, which might mean analysing logs weekly or using software tools to alert them to potential issues.
Keep it running
Audit VPN client/gateway configs to confirm split tunnelling is disabled; monitor for users enabling it and enforce via central policies/profiles.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The VPN configuration policy: Request to see the documented company policy that bans split tunnelling.
Look at
The details to ensure it clearly outlines that split tunnelling is disabled.
Good evidence
Will have a policy document that specifies 'split tunnelling is disabled' with a date it was last updated.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of the VPN settings: Request an example of a device connected to the VPN.
Look at
The routing settings to ensure all traffic is correctly routed through the company's network.
Good evidence
Would show all internet traffic being directed via the VPN with no exceptions.
- Check 3 of 5What an auditor asks for
Ask for
Network traffic logs: Request recent logs that show data traffic patterns.
Look at
Whether the traffic flows show a consistent routing through the VPN without direct internet connections.
Good evidence
Demonstrates that all logs show connections solely through the company's VPN.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of staff training: Request records of any training sessions or communications about VPN usage policies.
Look at
Attendance records or distributed materials on prohibiting split tunnelling.
Good evidence
Shows documented training or communication about correct VPN use to employees.
- Check 5 of 5What an auditor asks for
Ask for
IT report on network monitoring activities: Request a summary of monitoring activities or reports on VPN use.
Look at
Details on how the network is being monitored and any issues found.
Good evidence
Will include documented checks that confirm no split tunnelling is occurring.
Mappings
Closest match in ISO/IEC 27001: A.6.7, Remote working security measures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.7.
ISM-0705 requires organisations to disable split tunnelling when connecting to the organisation's network over VPN. Annex A 6.7 requires implementing security measures for remote working to protect information accessed or processed outside the organisation's premises, which commonly includes secure remote access configurations such as VPN policy enforcement. ISM-0705 is a specific remote-access technical safeguard within the broader remote working control scope of Annex A 6.7.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.