ASD ISM 1270 Database servers on separate network segment
What it says
Database servers are placed on a different network segment to workstations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDatabase servers should be placed on a separate network segment from workstations, for enhanced security.
Imagine your database servers as a secure vault holding your most valuable information. By keeping them on a separate network segment from your everyday work computers, you make it much harder for potential intruders to access that vault. A compromised workstation cannot simply reach the database servers because it sits on a different part of the network, reducing the chance of important data being stolen or tampered with.
Free. Save your status, tasks and notes.
Why it matters
If database servers are on the same network as workstations, attackers exploiting a compromised device can easily reach critical databases. This arrangement increases the risk of sensitive data manipulation or exfiltration without detection. Improper network segmentation can lead to catastrophic data leaks and loss of trust from clients and stakeholders.
How to implement
Set up a virtual local area network (VLAN) for your database servers, which helps isolate them from other devices like workstations.
Your network administrator can configure this on your switches to ensure database traffic stays separate.
Use firewalls to control and restrict the flow of traffic between the database VLAN and other network segments.
Ensure that only necessary data connections are allowed, minimising the risk of external threats reaching your databases.
Configure access control lists (ACLs) on network devices, such as routers and switches, to enforce strict rules about which devices can communicate with the database servers.
This extra layer of control helps reduce exposure to unauthorised access.
Go through your address plan and switch port assignments so that no workstation sits in the database segment.
Move any workstation found in the database VLAN or subnet to the workstation segment, and set the switch ports used by workstations so they cannot be placed in the database VLAN.
Route workstation access to databases through the application tier rather than directly.
Confirm that the only permitted paths from the workstation segment to the database segment are the explicitly allowed ones, such as application servers or administrator jump hosts, and block direct workstation-to-database connections at the segment boundary.
Keep it running
Keep the database segment free of workstations as hosts are added, moved or rebuilt: check the segment and address allocation before any new database server is deployed, and confirm that no workstation is ever assigned an address in the database segment. Review the firewall and access control list (ACL) rules between the workstation and database segments whenever a new application or database is introduced, so that workstation-to-database traffic stays confined to the application tier or explicitly allowed paths. Update network diagrams and address plans after significant infrastructure changes so they continue to show where database servers sit relative to workstations.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the network diagram showing the database server VLAN and its separation from the workstation network.
Look at
Examine the diagram for a clearly marked, separate segment dedicated to database servers.
Good evidence
A good network diagram displays an isolated VLAN for database servers with distinct boundaries from other network areas.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the configuration settings of the firewall governing the database network segment.
Look at
Check the rules to confirm that only essential data flows are permitted in and out of the database VLAN.
Good evidence
Firewall rules that strictly limit access to the database servers, allowing only necessary traffic, signify robust control.
- Check 3 of 5What an auditor asks for
Ask for
Request access control list (ACL) configurations applied on network devices for the database segment.
Look at
Verify that ACL rules are in place to restrict communication specifically to or from the database VLAN.
Good evidence
Effective ACLs will show restricted IP address ranges and port access to and from the database network segment.
- Check 4 of 5What an auditor asks for
Ask for
Request the IP address plan or VLAN assignments and ask for a connectivity test from a workstation VLAN to a database server.
Look at
Check that no workstation addresses fall within the database segment and that a connection attempt from a workstation to a database server port is blocked.
Good evidence
Workstations and database servers occupy different VLANs or subnets, and a test from a workstation cannot reach the database servers directly.
- Check 5 of 5What an auditor asks for
Ask for
Ask which paths are permitted from the workstation segment to the database segment, and request the rules that define them.
Look at
Confirm that the permitted paths are limited to the application tier or other explicitly allowed sources such as administrator jump hosts, rather than the workstation segment as a whole.
Good evidence
Workstation-to-database traffic is confined to the application tier or a small set of explicitly allowed paths, with direct workstation access blocked at the segment boundary.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1270 requires a concrete network architecture outcome: database servers are separated onto a different network segment from user workstations. This relates to Annex A 8.20 because securing and controlling networks and network devices commonly includes designing segmentation and enforcing traffic controls between segments. Annex A 8.20 is broader and includes many other network security measures (e.g. device hardening, secure management, and monitoring), while ISM-1270 is focused specifically on segmentation placement for database servers.
This control partially meets A.8.22.
ISM-1270 requires a specific segregation outcome: database servers must sit on a different network segment to workstations. ISO/IEC 27001:2022 Annex A 8.22 more generally requires segregating groups of services, users and systems across the organisation's networks. ISM-1270 is a concrete, scoped instance of the broader segregation requirement in Annex A 8.22 (focused on the database-to-workstation boundary).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.