ASD ISM 1192 Inspecting and filtering data with gateways
What it says
Gateways inspect and filter data flows at the transport and above network layers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGateways check and filter data to ensure only safe data passes through the network.
Gateways are like checkpoints in your network that inspect the flow of data to make sure only safe information gets through. This is important because without these checks, harmful data could enter your network and compromise your systems, leading to data theft or operational disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without gateway inspection and filtering at transport layers and above, malicious or unauthorised traffic can reach internal services, causing compromise and data loss.
How to implement
Small business owners should work with their IT team to identify where gateways need to be placed in the network.
Make sure these gateways are set up at entry and exit points of the network, so all data going in and out is checked.
IT teams should configure the gateways to automatically block any data identified as a threat.
This involves using tools that detect known problematic patterns in data, and setting rules in the gateway to prevent them from passing through.
Managers should plan for regular updates of the gateway's software to ensure they can detect the latest threats.
Work with IT vendors to receive timely updates and apply them promptly to the system.
Office managers should establish a protocol for monitoring the gateway's activity logs.
Ensure a designated person reviews these logs daily to spot any suspicious activity, like repeated access attempts or unusual data flows.
Board members should ensure there is a policy requiring all staff to report unexpected or suspicious network activity immediately.
Conduct training to make staff aware of what behaviours to report, and how to communicate these effectively.
Keep it running
Review gateway L4/L7 inspection policies (e.g., protocol validation, allowed ports, application controls), tune rules from log alerts, and update signatures/rulesets.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network diagram showing gateway placement: Request a visual map of the network that highlights all locations where gateways are implemented.
Look at
The points where external internet meets the internal network.
Good evidence
Clear diagrams showing gateways at all entry and exit points.
- Check 2 of 5What an auditor asks for
Ask for
The configuration rules set on the gateways: Request documentation or screenshots showing the specific rules that govern data filtering.
Look at
The level of detail and currency of these rules.
Good evidence
Recent, detailed rules aligned with known threats and updated within the last quarter.
- Check 3 of 5What an auditor asks for
Ask for
A log of security incidents related to data entry: Request a report of past security events that involved the inflow or outflow of data through the gateway.
Look at
The incidents' frequency and resolution timelines.
Good evidence
Logs showing timely action taken on incidents, with learnings applied.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of gateway software updates: Request records or confirmation of the latest gateway software versions and their update dates.
Look at
The frequency and recency of updates.
Good evidence
Regular updates in line with manufacturer recommendations, applied within the last month.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records on reporting network threats: Request documentation or records of training sessions conducted for staff about network threat identification.
Look at
Attendance and content relevance.
Good evidence
Completed training logs from the last six months, covering threat identification and response procedures.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1192 requires gateways to inspect and filter data flows at the transport layer and above to control what traverses network boundaries. This relates directly to Annex A 8.20, which requires networks and network devices to be secured, managed and controlled, including use of security capabilities such as secure gateways and filtering controls. Annex A 8.20 is broader because it covers overall network/device security management, including configuration, segmentation, hardening and monitoring, whereas ISM-1192 focuses specifically on gateway inspection and filtering behaviour.
This control partially overlaps A.8.12.
ISM-1192 requires gateways to inspect and filter data flows at the transport layer and above to prevent unsafe or unauthorised content traversing the network. This overlaps with Annex A 8.12 because data leakage prevention commonly relies on inline inspection and policy-based filtering at network egress/ingress points, often implemented on secure web/email gateways or similar controls. Annex A 8.12 extends beyond gateways into endpoint and application controls and focuses specifically on preventing sensitive information exfiltration, while ISM-1192 is not limited to sensitive data and is oriented to general traffic safety and policy enforcement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.