ASD ISM 1277 Encrypt database and web server communications
What it says
Data communicated between database servers and web servers is encrypted using Australian Signals Directorate-approved cryptography.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishData exchanged between database and web servers must use approved encryption methods.
This control ensures that any data exchanged between your web servers and database servers is securely encrypted. If this isn't done, sensitive information like customer data or company secrets could be intercepted by cybercriminals, leading to financial and reputational damage.
Free. Save your status, tasks and notes.
Why it matters
Unencrypted data between servers could be intercepted, leading to breaches of confidential information and damaging trust with customers.
How to implement
The IT team should select encryption methods approved by the Australian Signals Directorate (ASD).
Check the latest ASD guidelines to ensure the encryption technology is current and complies with standards.
System owners need to work with their IT team to ensure all data communications between web and database servers are encrypted.
They can verify this by ensuring encryption settings are correctly enabled on all relevant systems.
Managers should ensure regular staff training is conducted to raise awareness about the importance of encrypting data.
Training should cover how encryption protects sensitive information from unauthorised access.
The IT team should regularly update encryption certificates to prevent expired certificates from causing data vulnerabilities.
Set reminders for certificate renewal and ensure system configurations are adjusted accordingly.
System administrators should routinely monitor server logs for any unencrypted data transmissions.
They should configure alerts to detect and respond to any anomalies or failures in encryption protocols.
Keep it running
Regularly review and renew encryption certificates, and ensure team members understand and follow current ASD-approved encryption practices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for documentation of the encryption methods used between database servers and web servers.
Look at
Look at whether the algorithms, protocols and key lengths are ASD-approved.
Good evidence
Up-to-date records that reference the ASD guidelines for approved cryptography.
- Check 2 of 5What an auditor asks for
Ask for
Request the server configuration files or settings for the web servers and database servers.
Look at
Check that encryption is enabled for the communications between the web and database tiers.
Good evidence
Active encryption settings that match ASD-approved cryptography, with no unencrypted fallback.
- Check 3 of 5What an auditor asks for
Ask for
Ask to see records of staff training sessions about data encryption.
Look at
Look for attendance records and the training materials used.
Good evidence
Recent training that is relevant to encrypting database and web server communications.
- Check 4 of 5What an auditor asks for
Ask for
Request logs confirming regular checks of the encryption protocols in use.
Look at
Ensure the logs show checks are being performed and that any issues are resolved promptly.
Good evidence
Few, if any, unaddressed issues remaining in the logs.
- Check 5 of 5What an auditor asks for
Ask for
Ask for details of the encryption certificate management process.
Look at
Look at certificate expiry dates and how renewal is managed.
Good evidence
A process with reminders for renewal well before expiry dates, so encryption is never interrupted.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.14.
ISM-1277 requires that data communicated between database servers and web servers is encrypted to protect it in transit. Annex A 5.14 requires the organisation to define and implement rules/procedures/agreements for information transfer across transfer facilities, which would typically include mandating encryption for sensitive internal service-to-service traffic such as web-to-database connections. ISM-1277 is a specific technical requirement for one transfer path, while Annex A 5.14 is broader governance over many transfer methods and contexts.
This control partially meets A.8.24.
ISM-1277 requires encryption of data in transit specifically between web servers and database servers. Annex A 8.24 requires rules for effective use of cryptography and cryptographic key management across the organisation, which directly underpins implementing and sustaining TLS/mTLS (including certificate lifecycle) for web-to-database communications. ISM-1277 is one concrete application of cryptography-in-transit, whereas Annex A 8.24 also covers broader cryptographic use cases and key management beyond this single link.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.