ASD ISM 1271 Restrict network access to database servers
What it says
Network access controls are implemented to restrict database server communications to strictly defined network resources that require access to the database server.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDatabase server communications are limited to necessary network resources only.
This control is about making sure that your database servers only communicate with parts of the network that really need to. It matters because if you don't do this, hackers could more easily sneak into other sensitive parts of your network through the database, potentially leading to data theft or system disruptions.
Free. Save your status, tasks and notes.
Why it matters
If database servers allow broad network access, attackers can reach exposed database ports, leading to unauthorised data access, breaches and server compromise.
How to implement
The IT team should identify all parts of the network that need access to the database servers.
Start by listing applications and services that connect to the database and verify with each department that these connections are still necessary.
Managers should ensure that network access rules are up to date.
Have a session with the IT team to go over existing network rules and remove or limit any that don't have a clear business need.
The IT team should set up network firewalls or similar tools to block unwanted access.
Configure firewalls by setting rules that only allow connections from verified systems and departments based on the credibility and necessity of their access.
System owners should regularly review who has access to the database servers.
Hold periodic reviews, both scheduled and in response to any changes, to make sure only essential users maintain access.
IT security personnel should educate staff about the importance of restricting database access.
Conduct training sessions explaining how network access control helps protect the company's data and emphasise individual responsibilities in maintaining security.
Keep it running
Restrict database server ports to approved subnets/hosts only; regularly review firewall/ACL allow-lists and alert on failed or unexpected connections to database services.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network access policy document: Secure a copy of the policy detailing access to the database servers.
Look at
Specific rules about which networks or devices are allowed.
Good evidence
Policies with clear access rules and justification for each allowed connection.
- Check 2 of 5What an auditor asks for
Ask for
A network diagram showing database connections: Request a diagram illustrating how databases connect within the network.
Look at
Clear and limited connections to necessary systems only.
Good evidence
Diagram showing restricted and necessary connections, visually confirming access rules.
- Check 3 of 5What an auditor asks for
Ask for
Logs from network firewalls or similar tools: Obtain logs that detail access attempts to the database servers.
Look at
Logs showing successful attempts only from authorised IP addresses or systems.
Good evidence
Logs with no unauthorised or unexpected access attempts.
- Check 4 of 5What an auditor asks for
Ask for
The most recent access review report: Request a report of the last review of who can access the databases.
Look at
Entries indicating departmental verification and any changes made as a result.
Good evidence
Recent report showing changes acted on and approved with clear business rationale.
- Check 5 of 5What an auditor asks for
Ask for
Training materials on access security: Request copies of the materials used in staff training sessions on restricting database access.
Look at
Content covering policy details and individual responsibilities.
Good evidence
Comprehensive materials detailing access importance and employee role in security.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1271 requires network access controls that restrict database server communications to strictly defined network resources that need access. Annex A 8.20 requires organisations to secure, manage and control networks and network devices to protect information in systems and applications, which includes implementing filtering, firewalling and controlled routing. ISM-1271 is a specific application of network security management focused on database server connectivity, whereas Annex A 8.20 covers network/device security more broadly across the environment.
This control partially overlaps A.8.22.
ISM-1271 requires organisations to restrict database server communications to only the network resources that require access. Annex A 8.22 requires segregation of groups of information services, users and information systems within networks, commonly implemented via VLANs, zones, and firewall rules that can limit which segments can reach a database. Annex A 8.22 is broader (segregation across the network), while ISM-1271 is narrower but may also require controls beyond segmentation (e.g. explicit allow-lists for DB ports and source systems).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.