ASD ISM 1037 Regular testing of gateway security configurations
What it says
Gateways undergo testing following configuration changes, and at regular intervals no more than six months apart, to validate that they conform to expected security configurations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGateways are tested every six months or after changes to ensure they meet security standards.
Every six months, or when there are changes, your network gateways must be tested to make sure they're keeping your systems protected. This is crucial because if gateways aren't secure, hackers could break in and create chaos, like stealing sensitive info or disrupting operations.
Free. Save your status, tasks and notes.
Why it matters
Without regular gateway testing, you risk cyber attacks that could compromise sensitive data and disrupt your business operations.
How to implement
The IT team should regularly schedule and conduct security tests on gateways.
Use a calendar reminder and specific security testing tools to check that settings match your security standards.
Office managers and IT should collaborate after any changes to the network gateway to ensure all configurations remain secure.
This can involve a checklist to verify settings and permissions.
Business owners should allocate a budget for necessary tools and any external security testing services to validate gateway security.
Research and choose reputable security consultancy services if needed.
System owners should document all changes to the gateway configuration for reference during tests.
Maintain a log of changes and ensure it is easily accessible to everyone involved in security.
IT staff should be trained regularly on potential security threats to gateways and how to spot issues during testing.
Schedule quarterly training sessions to keep the team updated.
Keep it running
Regularly update and review your security testing schedule to ensure no tests are missed, and promptly act on any issues found.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the gateway testing schedule: Check how often testing is planned and if it aligns with the six-month requirement.
Look at
past dates and next planned date.
Good evidence
would show tests no further apart than six months.
- Check 2 of 5What an auditor asks for
Look at
specific dates and signed reports.
Good evidence
will show tests immediately following changes.
- Check 3 of 5What an auditor asks for
Ask for
documentation of identified issues and fixes from the last gateway test: Check that issues were found and correctly resolved.
Look at
detailed problem and solution descriptions.
Good evidence
has clear entries with successful resolution notes.
- Check 4 of 5What an auditor asks for
Look at
dates, topics, and attendance.
Good evidence
shows regular, ongoing training activities.
- Check 5 of 5What an auditor asks for
Ask for
to see logs of all gateway configuration changes: Assess these logs to make sure any change is followed by testing.
Look at
change records and subsequent testing entries.
Good evidence
details every change and its corresponding test.
Mappings
Closest match in ISO/IEC 27001: A.5.36, Review compliance with information security policies, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.36.
ISM-1037 requires gateways to be tested after changes and at least every six months to validate conformance to expected security configurations. Annex A 5.36 requires regular review of compliance with information security policies, rules and standards, which can be evidenced by periodic technical configuration conformance testing of gateways. ISM-1037 is a technical, gateway-specific compliance validation mechanism with a defined frequency, while Annex A 5.36 is broader and can be performed through non-technical governance reviews as well.
This control partially meets A.8.9.
ISM-1037 requires gateways to be tested after configuration changes and at least every six months to confirm they conform to expected security configurations. Annex A 8.9 requires organisations to establish, document, implement, monitor and review security configurations across hardware, software, services and networks, which would include gateways and the need to verify configuration state. ISM-1037 is a specific verification/testing cadence applied to gateways, whereas Annex A 8.9 is broader configuration management across the environment without prescribing a six-month test interval.
This control partially overlaps A.5.35.
ISM-1037 requires gateways to be tested after configuration changes and at least every six months to confirm they meet expected security configurations. Annex A 5.35 requires independent reviews at planned intervals or when significant changes occur, which overlaps with ISM-1037's trigger-based and periodic assurance concept for gateways. ISM-1037 is specifically about technical testing of gateway configurations and prescribes a maximum interval, whereas Annex A 5.35 is organisation-wide and emphasises independence rather than a particular technical test cadence.
This control supports A.8.21.
Annex A 8.21 requires security mechanisms for network services to be implemented and monitored. ISM-1037 supports this by requiring gateways to be tested after changes and at least every six months to validate expected security configurations, which is a form of assurance/monitoring over a critical network service component. ISM-1037 is gateway-specific and focuses on configuration validation cadence, while Annex A 8.21 covers broader network services, including defining service levels and requirements beyond configuration compliance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.