ASD ISM 1028 Use NIDS/NIPS for gateway network security
What it says
A NIDS or NIPS is deployed in gateways between an organisation's networks and other networks they do not manage.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInstall systems at network gateways to monitor and protect against unauthorised access or threats from other networks.
We need to place smart security software where our network connects to the outside world. Why? Because it helps us spot and stop intruders before they can snoop around or cause trouble. If we don't do this, hackers could sneak in and access our sensitive data or cause disruptions, hurting our business and our reputation.
Free. Save your status, tasks and notes.
Why it matters
Lack of NIDS/NIPS at gateways exposes networks to undetected intrusions, risking data breaches and significant business disruptions.
How to implement
The IT team should identify key network gateways, which are the points where our network connects to the internet or other networks.
They should pinpoint these using network maps and diagrams to ensure all possible entry points are protected.
IT professionals should install Network Intrusion Detection Systems (NIDS) or Network Intrusion Prevention Systems (NIPS) at these gateways to monitor traffic.
They can do this by purchasing software from reputable vendors and following installation guides specific to each type of system.
Network administrators should regularly update the NIDS/NIPS software to keep it equipped against new threats.
They should set a schedule for updates and conduct them outside of business hours to limit disruption.
The cyber security team should configure the NIDS/NIPS to alert them of unusual network activity.
They can do this by setting thresholds and rules within the software to flag potential threats for further investigation.
Managers should provide training for IT staff on how to respond to alerts from NIDS/NIPS.
They can hold workshops or online training sessions, ensuring staff know their roles when a threat is detected.
Keep it running
Tune and update gateway NIDS/NIPS signatures, rules and baselines to detect new threats and reduce false positives.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network diagram showing all gateways: Confirm this document includes clear labels for each network gateway point.
Look at
Comprehensive coverage of all entry points.
Good evidence
Is a diagram with all gateways marked, updated in the past year.
- Check 2 of 5What an auditor asks for
Good evidence
Is full coverage with current versions used.
- Check 3 of 5What an auditor asks for
Ask for
Documentation of alert configurations: This should detail the rules set up in NIDS/NIPS for detecting threats.
Look at
Specificity in what constitutes an alert and how it's escalated.
Good evidence
Shows detailed thresholds and procedures outlined.
- Check 4 of 5What an auditor asks for
Look at
The attendance roster to ensure key IT personnel have participated.
Good evidence
Includes recent and frequent training sessions noted.
- Check 5 of 5What an auditor asks for
Ask for
Update logs: These should show the schedule and completion of recent updates to the NIDS/NIPS software. Look to ensure updates align with recommended frequencies from software vendors.
Good evidence
Shows all systems routinely maintained and updated.
Mappings
Closest match in ISO/IEC 27001: A.8.16, Monitoring networks and systems for anomalous behaviour, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.16.
ISM-1028 requires a NIDS/NIPS at network gateways to detect and/or prevent unauthorised or malicious traffic crossing organisational boundaries. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring of networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents. A gateway NIDS/NIPS implemented under ISM-1028 provides a key telemetry and alerting source that strengthens the monitoring outcomes required by Annex A 8.16, but Annex A 8.16 is broader and not limited to gateways or IDS/IPS technology.
This control partially meets A.8.20.
Annex A 8.20 addresses securing and controlling networks and network devices across the environment to protect information in systems and applications. ISM-1028 requires deploying NIDS/NIPS in gateways between organisational networks and networks not managed by the organisation, providing detection/prevention at key boundaries. This is a specific implementation of network security within the broader Annex A 8.20 control set, which also includes device configuration, segmentation, and network service governance beyond gateway IDS/IPS deployment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.