ASD ISM 1181 Segregate networks by server criticality
What it says
Networks are segregated into multiple network zones according to the criticality of servers, services and data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNetworks have separate zones based on the importance of servers, services, and data.
This control is about splitting your computer network into separate parts based on how important the servers and data are. By doing this, you can protect the really important bits better, because if the weaker areas of your network are attacked, the attackers can't easily reach the crucial parts where sensitive data might be stored.
Free. Save your status, tasks and notes.
Why it matters
Without network segregation, a breach in one area could provide attackers seamless access to high-value servers, risking critical data exposure and significant damage.
How to implement
The IT team should identify critical servers and data: Start by making a list of all the servers and which ones hold the most important or sensitive information.
This can be done by reviewing what data or services these servers handle and determining how essential they are to the business.
IT managers should create distinct network zones: Once critical servers are identified, segment the network into zones.
Put the most sensitive servers in a highly secure zone and apply stricter access controls by using network configuration tools or firewall rules.
System administrators should control access between zones: Set rules about who can move between network zones.
This could mean setting up permissions so only certain employees can access specific zones, using password protection or physical access controls.
The IT team should regularly audit network segmentation: Conduct regular checks to make sure that the separation between network zones is maintained.
Use tools that show network traffic to verify that data is only moving between zones as authorised.
System owners should review the criticality of servers periodically: Every few months, have a meeting to review your list of critical servers and update any changes to server importance or data sensitivity.
Document any changes and update network zones as necessary.
Keep it running
Review server criticality regularly and adjust network zones, firewall rules and routing so high-value services and data remain isolated from lower-trust areas.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network zoning plan: Request the document or map showing the network's different zones.
Look at
How the zones are defined and check if high-criticality servers are in the most restricted zones.
Good evidence
Is a map showing clear separation and stricter rules for access to important servers.
- Check 2 of 5What an auditor asks for
Ask for
To see logs or reports showing who has accessed different zones in the network.
Look at
Records that match access policies and document who has been allowed to pass between zones.
Good evidence
Is logs showing access requests approved for legitimate reasons only.
- Check 3 of 5What an auditor asks for
Good evidence
Is a comprehensive list that shows each server's importance and its corresponding network zone.
- Check 4 of 5What an auditor asks for
Ask for
To see network monitoring records: Request records or summaries from network monitoring tools.
Look at
Evidence that traffic between zones is monitored regularly.
Good evidence
Is a report showing regular checks and an alert system for unusual activity between zones.
- Check 5 of 5What an auditor asks for
Ask for
The most recent audit of the network segmentation.
Look at
Findings regarding zone integrity and any actions taken to address gaps.
Good evidence
Is a report detailing what was checked, who did it, and documented proof of any issues being rectified.
Mappings
Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control is equivalent to A.8.22.
ISM-1181 requires networks to be segregated into multiple zones based on the criticality of servers, services and data. ISO/IEC 27001:2022 Annex A 8.22 similarly requires segregation of groups of information services, users and information systems within organisational networks. ISM-1181 is more explicit about using criticality to drive zoning, but both controls are fundamentally met through implementing network segmentation and zone separation.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-18.1Isolate systems in criticality- and trust-based network zones with approved, monitored pathwaysPartially overlaps
This control partially overlaps IT.PRO-18.1.
IT.PRO-18.1 requires systems to be isolated in network zones by criticality and trust level, with access restricted and monitored; ISM-1181 requires networks to be segregated into multiple zones by the criticality of servers, services and data, the zoning part of that action.
- IT.PRO-18.2Restrict lateral movement between and within segments to approved pathways and servicesPartially overlaps
This control partially overlaps IT.PRO-18.2.
IT.PRO-18.2 requires lateral movement within and between network segments to be limited to approved pathways and services; ISM-1181 requires networks to be segregated into multiple zones by the criticality of servers, services and data, creating the segments that action controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.