ASD ISM 1182 Implement network traffic control measures
What it says
Network access controls are implemented to limit the flow of network traffic within and between network segments to only that required for business purposes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRestrict network traffic flow to ensure it only supports business needs.
This control is about making sure network traffic in your organisation is limited to only what is necessary for your business. By restricting unnecessary network connections, you protect your business from cyber threats and data breaches, keeping sensitive information safe.
Free. Save your status, tasks and notes.
Why it matters
Without network access controls between segments, unnecessary traffic paths enable lateral movement and data exfiltration across internal networks.
How to implement
IT team should map out all current network traffic: Make a list of systems that connect to each other across the network to understand what is needed for daily operations.
To do this, check what applications are running and identify which network connections are essential for your business activities.
Business manager and IT team should work together: Determine the business priorities that require network connectivity.
They should outline what traffic is necessary and what connections could be reduced or removed entirely to achieve a more secure network environment.
IT team should establish network segmentation: Divide your network into smaller segments and limit the flow of traffic between them.
Install proper security devices, like firewalls, at key points and set rules about which segments can talk to each other, ensuring only critical business traffic is permitted.
System owner should regularly review network access: Conduct regular reviews, like every quarter, to ensure network traffic rules remain aligned with current business needs.
Document any changes in traffic patterns and update access rules as necessary.
IT team should monitor network activities: Put in place a system for monitoring ongoing network traffic to detect and manage unusual or unauthorised access attempts.
Use alerts to notify the team of unexpected traffic patterns or potential intrusions that need immediate investigation.
Keep it running
Maintain allow-listed inter-segment rules (deny by default), review firewall/ACL changes, and monitor east-west flows to confirm only business-required traffic is permitted.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network diagram: Request the current map showing all network segments and connections.
Look at
How traffic flows between segments and check if it aligns with business needs.
Good evidence
A clear diagram showing segmented network paths with justifications for each connection.
- Check 2 of 5What an auditor asks for
Ask for
A list of network access rules: Request documentation of current network controls in place.
Look at
The rules set for which segments can talk to each other and verify they match the stated business requirements.
Good evidence
A detailed list showing segment access rules with business justification.
- Check 3 of 5What an auditor asks for
Ask for
Recent network access reviews: Request records of the latest reviews of network traffic control measures.
Look at
The frequency and scope of the review processes.
Good evidence
Dated reviews showing analysis of traffic patterns and documented changes made for business alignment.
- Check 4 of 5What an auditor asks for
Ask for
Incident reports related to network traffic: Request reports of any security incidents related to network access.
Look at
How incidents were handled and what changes were made to prevent recurrence.
Good evidence
Completed incident reports showing response measures and preventive actions taken.
- Check 5 of 5What an auditor asks for
Ask for
Monitoring logs or alerts: Request samples of logs from network monitoring activities.
Look at
The events logged and how alerts are raised and resolved.
Good evidence
Logs showing proactive monitoring with documented response to anomalies.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
Annex A 5.15 requires rules to control logical and physical access to information and assets based on business need. ISM-1182 mandates network access controls to restrict traffic flows between segments to what is required for business purposes, which is a specific form of logical access restriction. Annex A 5.15 is broader because it covers all access control policy/procedure domains (users, systems, data, physical entry), not only network segmentation and traffic flow.
This control partially meets A.8.20.
ISM-1182 requires limiting the flow of network traffic within and between network segments to only what is required for business purposes. Annex A 8.20 requires networks and network devices to be secured, managed and controlled more generally to protect information in systems and applications. ISM-1182 is a specific subset of Annex A 8.20 focused on traffic-flow control (e.g., segmentation enforcement, ACLs, firewall policy) rather than all aspects of network/device security management.
This control partially overlaps A.8.21.
Annex A 8.21 requires organisations to implement and monitor security mechanisms for network services and ensure they meet defined requirements. ISM-1182 relates by requiring network access controls that limit traffic flows within and between segments to business-required communications, which is a core network service security mechanism. ISM-1182 is more prescriptive about internal traffic flow control, while Annex A 8.21 additionally covers service level definition/assurance and security requirements for specific network services (e.g. DNS, remote access, managed links).
This control partially overlaps A.8.22.
Annex A 8.22 requires segregating groups of information services, users, and information systems within organisation networks to limit risk and control interconnection. ISM-1182 complements this by requiring network access controls that restrict traffic flows within and between segments, focusing on governing permitted traffic paths.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-18.2Restrict lateral movement between and within segments to approved pathways and servicesPartially overlaps
This control partially overlaps IT.PRO-18.2.
IT.PRO-18.2 requires lateral movement within and between network segments to be limited to approved pathways by business need and trust level; ISM-1182 requires network access controls to limit traffic within and between segments to business needs, a close match except for trust.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.