ASD ISM 1178 Limit network documentation for third parties
What it says
Network documentation provided to a third party, or published in public tender documentation, only contains details necessary for other parties to undertake contractual services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen sharing network details, only provide what's needed for others to fulfil their contracts.
Only share network details with third parties that they absolutely need to do their job. This is important because giving away too much information can make your systems vulnerable to security breaches or misuse.
Free. Save your status, tasks and notes.
Why it matters
Over-sharing network diagrams, IP ranges, and access paths with third parties can enable targeted intrusion, raising breach and outage risk.
How to implement
The IT manager should identify what network information third parties need for their tasks.
Make a list of required details by consulting with the parties to ensure nothing unnecessary is included.
Procurement teams should include a clause in contracts that limits the sharing of network information to only what's needed.
Ensure all new contracts specify the minimal details third parties should receive.
Managers overseeing projects with third party involvement should hold a briefing with their teams.
Discuss exactly what network details are needed and document these discussions to avoid any unnecessary disclosures.
Security officers should conduct a review of all network documentation before it is distributed.
Check the documents to ensure they align with the agreed list of necessary details and remove any extraneous information.
IT teams should keep a record of what network information has been shared and with whom.
Use a simple tracking system to log each sharing instance, documenting the reasons and approvals for sharing the information.
Keep it running
Before sharing with vendors/tenders, redact non-essential details (e.g., IP ranges, device names, trust links) and record approvals for released docs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the current contracts with third parties: Request documentation that details network information sharing terms.
Look at
Specific clauses limiting information sharing to necessary content.
Good evidence
Includes clear contractual language restricting network information to what is specifically needed.
- Check 2 of 5What an auditor asks for
Ask for
Access to the network documentation sharing log: Request to see records of what network information has been shared and with whom.
Look at
Entries with clear justifications and authorisations for each instance.
Good evidence
Will have detailed logs with minimal entries and clear authorisations.
- Check 3 of 5What an auditor asks for
Ask for
About the review process of network documentation: Request procedures showing how network documents are reviewed before sharing.
Look at
The steps ensuring excessive details are removed.
Good evidence
Demonstrates a robust review process involving a security officer's sign-off.
- Check 4 of 5What an auditor asks for
Ask for
Communication records about briefings with teams: Request minutes or notes from meetings where network detail sharing was discussed.
Look at
Details on decisions made about what to share.
Good evidence
Includes documented discussions with clear outcomes and responsible parties.
- Check 5 of 5What an auditor asks for
Ask for
About the training materials for managing network information sharing: Request examples of training provided to staff on this topic.
Look at
Specific guidance on the importance and practices of minimal information sharing.
Good evidence
Includes relevant, regular training materials that cover the importance of limiting information.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.14.
ISM-1178 requires that network documentation shared with third parties (including in public tenders) is limited to only what is necessary to perform contractual services. Annex A 5.14 requires the organisation to define and apply rules, procedures or agreements for transferring information internally and to other parties, which includes setting conditions and content for what is shared. ISM-1178 is a specific application of information transfer governance focused on minimising network detail exposure to external parties, whereas Annex A 5.14 is broader across all transfer types and information.
This control partially meets A.5.19.
ISM-1178 requires that network documentation provided to third parties is restricted to the minimum necessary for contractual delivery. Annex A 5.19 requires processes and procedures to manage information security risks arising from supplier relationships, which would typically include controlling what internal technical information (such as network diagrams and addressing) is disclosed to suppliers. ISM-1178 strengthens supplier risk management by reducing the impact of over-disclosure, but Annex A 5.19 also covers broader supplier governance beyond documentation content.
This control partially overlaps A.5.20.
ISM-1178 requires limiting the amount of network documentation shared with third parties to what is necessary for contractual services. Annex A 5.20 requires integrating information security requirements into supplier agreements, which can include contractual constraints on what network information is requested, provided, used and re-disclosed. The overlap is in controlling third-party disclosure via contractual mechanisms, but ISM-1178 is specifically about content minimisation of network documentation, while Annex A 5.20 is about embedding a wider set of security clauses across the supplier lifecycle.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.7.
Annex A 6.2.7 requires determining and providing AI system technical documentation to relevant interested parties in an appropriate form. ISM-1178 constrains what network documentation can be provided to third parties to only what is necessary, which directly affects how much AI system technical documentation (where it includes network/architecture details) can be shared externally under Annex A 6.2.7. ISM-1178 is a minimisation/need-to-know constraint on disclosure, whereas Annex A 6.2.7 is a positive obligation to provide suitable documentation to specific audiences.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.