ISM-1272policyASD Information Security Manual (ISM)

Disable Database Networking for Local Access

If the database is only accessed locally, its network connection must be disabled or set to local only.

Preventative NC OS PASD Information Security ManualGuidelines for database systems Network security

record_voice_over

Plain language

This control means your database should only be accessed from the same computer it's running on. This matters because if someone from outside can connect to your database, they could steal or tamper with your sensitive information.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

June 2026

Control Stack last updated

18 June 2026

E8 maturity levels

N/A

Guideline

Guidelines for database systems

Section

Database Servers

Topic

Network Environment

Official control statement

If only local access to a database is required, networking functionality of database management system applications is disabled or directed to listen solely to the localhost interface.

policyASD Information Security Manual (ISM)ISM-1272

priority_high

Why it matters

If the database allows remote connections, unauthorised users might exploit this to access data or disrupt operations.

settings

Operational notes

Ensure ongoing checks of the database settings to maintain local-only access and prevent accidental exposure to wider networks.

02 - Implement

build

Implementation tips

System owners should review database access requirements: If the database doesn't need to be accessed from different computers over a network, configure it for local access. This can usually be done by setting it to 'local-only' mode.
IT teams should configure the database to listen only to localhost: This means the database will only accept connections that come from the same computer it's installed on. Check the database settings to ensure this configuration.
Managers should ensure staff know how to access the database locally: Provide training or guides on how to access the database without network connections if needed for daily tasks.
Procurement should document all local databases: Keep a record of what databases are configured for local use only, so audits and reviews can easily identify them.
System owners should schedule periodic checks: Regularly verify that the database settings haven't changed and that it still only allows local access. This can be part of routine system maintenance.

03 - Audit

fact_check

Audit / evidence tips

Askthe database configuration documentation: Request the settings files or screenshots that show the database's local access configuration
Look atthe database access logs: Check for entries that indicate connections from outside the local machine
Review IT team's procedural documents: Ensure they include steps for configuring databases to local access only.
Askthe periodic check logs or reports: Request evidence of regular reviews of database settings
Look atrecords that label databases designated for local access only

04 - Mappings

link

Cross-framework mappings

How ISM-1272 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 8.9	ISM-1272 requires a specific configuration state for database servers, where the DBMS is set to not accept remote connections unless need...
Annex A 8.20	ISM-1272 requires organisations to disable database networking or bind the DBMS listener to localhost when remote database access is not ...