ASD ISM 1157Use Evaluated Diodes to Control Unidirectional Gateway Data Flow
Official control statement
Evaluated diodes are used for controlling the data flow of unidirectional gateways between networks.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Unidirectional gateways between networks must use evaluated diodes to control the direction of data flow.
What this means in practice
This control ensures that when a unidirectional gateway connects two networks, an evaluated diode is used to control the direction that data can flow. A diode is a hardware device that permits information to move in only one direction, so data cannot travel back the other way. Choosing a diode that has been formally evaluated gives confidence that this one-way restriction genuinely holds and cannot be bypassed. This matters because it prevents sensitive information leaking, or unwanted traffic entering, across the boundary between the two networks.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Mar 2022
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
If unevaluated diodes are used, the one-way data flow of a unidirectional gateway may not be reliably enforced, allowing sensitive information to leak or unwanted traffic to cross between networks.
Operational notes
Periodically reconfirm that each deployed diode still holds a current evaluation and that no reverse data paths have been introduced at the gateway.
Implementation tips
- When deploying a unidirectional gateway between two networks, have network architects select a diode that has completed a formal evaluation rather than an unevaluated product.
- Configure the diode to enforce data flow in the intended single direction, and document which network is the sending side and which is the receiving side.
- Place the diode at the network boundary so all traffic between the two networks is forced through it, leaving no alternative path that could allow reverse flow.
- Record the make, model and evaluation status of each diode in the network design documentation and asset register so the evaluated component can be verified.
- When replacing or upgrading a diode, have engineers confirm the replacement product also holds a current evaluation before connecting it into the gateway.
Audit / evidence tips
- AskAsk which unidirectional gateways connect networks and what devices control their one-way data flow.Look atNetwork architecture diagrams and boundary designs showing where diodes are positioned.GoodEvery unidirectional gateway is shown controlling one-way flow through a named diode device.
- AskAsk for evidence that each diode in use has been formally evaluated.Look atProduct evaluation certificates or listings matched to the deployed diode models.GoodEach deployed diode model maps to a current, valid evaluation record.
- AskAsk how each diode enforces the intended direction of data flow.Look atDiode configuration and the documented sending and receiving networks.GoodConfiguration confirms data is permitted to flow only in the approved single direction.
- AskAsk whether any path could allow data to flow back around the diode.Look atBoundary network topology and the routing and firewall rules at the gateway.GoodNo alternative routes exist and all traffic between the networks is forced through the diode.
- AskAsk how diode assets and their evaluation status are tracked over time.Look atThe asset register and design documentation entries for the diodes.GoodRecords list each diode's make, model and evaluation status and are kept up to date.
Cross-framework mappings
How ISM-1157 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(3)expand_less | ||
| Annex A 8.12 | ISM-1157 requires evaluated diodes to control the data flow of unidirectional gateways between networks | |
| Annex A 8.20 | ISM-1157 requires evaluated diodes to control the data flow of unidirectional gateways between networks | |
| Annex A 8.22 | ISM-1157 requires evaluated diodes to control data flow in unidirectional gateways between networks | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Gateways
See all Guidelines for gateways controls, or browse the full ASD ISM library.