Skip to content
Database systems
ASD ISMISM-1272

ASD ISM 1272 Disable database networking for local access

What it says

If only local access to a database is required, networking functionality of database management system applications is disabled or directed to listen solely to the localhost interface.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

If the database is only accessed locally, its network connection must be disabled or set to local only.

This control means your database should only be accessed from the same computer it's running on. This matters because if someone from outside can connect to your database, they could steal or tamper with your sensitive information.

Why it matters

If the database allows remote connections, unauthorised users might exploit this to access data or disrupt operations.

How to implement

  1. System owners should review database access requirements: If the database doesn't need to be accessed from different computers over a network, configure it for local access.

    This can usually be done by setting it to 'local-only' mode.

  2. IT teams should configure the database to listen only to localhost: This means the database will only accept connections that come from the same computer it's installed on.

    Check the database settings to ensure this configuration.

  3. Managers should ensure staff know how to access the database locally: Provide training or guides on how to access the database without network connections if needed for daily tasks.

  4. Procurement should document all local databases: Keep a record of what databases are configured for local use only, so audits and reviews can easily identify them.

  5. System owners should schedule periodic checks: Regularly verify that the database settings haven't changed and that it still only allows local access.

    This can be part of routine system maintenance.

Keep it running

Ensure ongoing checks of the database settings to maintain local-only access and prevent accidental exposure to wider networks.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the database configuration documentation, such as the database management system settings files or screenshots showing the local access configuration.

    Look at

    Examine the networking settings for each database that only requires local access, checking whether networking is disabled or the listener is bound to the localhost interface.

    Good evidence

    Every database identified as local access only has networking functionality disabled or is configured to listen solely on the localhost interface, with no external bind addresses.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the database access logs or connection logs for the databases designated as local access only.

    Look at

    Check for entries that indicate connections from outside the local machine, such as remote IP addresses rather than localhost.

    Good evidence

    The logs show connections only from the local machine, with no evidence of remote network connections to databases that should be local access only.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for the IT team's procedural documents for building and configuring database servers.

    Look at

    Check that the procedures include steps for configuring databases to local access only, either by disabling networking or directing the listener to localhost.

    Good evidence

    The procedures clearly describe how to disable database networking or restrict it to the localhost interface when only local access is required.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for the periodic check logs or reports that show regular reviews of database settings.

    Look at

    Look for evidence that the local access configuration was reviewed, including dates, who performed the review and any deviations found and corrected.

    Good evidence

    Reviews occur regularly, confirm that networking remains disabled or bound to localhost for local access only databases, and any drift is recorded and remediated.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for the database inventory or asset list.

    Look at

    Look for records that label which databases are designated for local access only, and compare a sample against the actual configuration.

    Good evidence

    The inventory clearly identifies local access only databases, and the sampled databases match that designation with networking disabled or restricted to localhost.

Mappings

Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.9Configuration management for secure IT systemsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.