What does ASD ISM 1277 require?

policyASD Information Security Manual (ISM)

ASD ISM 1277Encrypt Database and Web Server Communications

Official control statement

Data communicated between database servers and web servers is encrypted using Australian Signals Directorate-approved cryptography.

policyASD Information Security Manual (ISM)ISM-1277

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Data exchanged between database and web servers must use approved encryption methods.

NC OS PASD Information Security ManualGuidelines for database systems

Control Stack classificationPreventative Cryptography Database security

record_voice_over

What this means in practice

This control ensures that any data exchanged between your web servers and database servers is securely encrypted. If this isn't done, sensitive information like customer data or company secrets could be intercepted by cybercriminals, leading to financial and reputational damage.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

June 2026

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for database systems

Section

Database servers

Topic

Communications between database servers and web servers

priority_high

Why it matters

Unencrypted data between servers could be intercepted, leading to breaches of confidential information and damaging trust with customers.

settings

Operational notes

Regularly review and renew encryption certificates, and ensure team members understand and follow current ASD-approved encryption practices.

02 - Implement

build

Implementation tips

The IT team should select encryption methods approved by the Australian Signals Directorate (ASD). Check the latest ASD guidelines to ensure the encryption technology is current and complies with standards.
System owners need to work with their IT team to ensure all data communications between web and database servers are encrypted. They can verify this by ensuring encryption settings are correctly enabled on all relevant systems.
Managers should ensure regular staff training is conducted to raise awareness about the importance of encrypting data. Training should cover how encryption protects sensitive information from unauthorised access.
The IT team should regularly update encryption certificates to prevent expired certificates from causing data vulnerabilities. Set reminders for certificate renewal and ensure system configurations are adjusted accordingly.
System administrators should routinely monitor server logs for any unencrypted data transmissions. They should configure alerts to detect and respond to any anomalies or failures in encryption protocols.

03 - Audit

fact_check

Audit / evidence tips

AskAsk for documentation of the encryption methods used between database servers and web servers.Look atLook at whether the algorithms, protocols and key lengths are ASD-approved.GoodUp-to-date records that reference the ASD guidelines for approved cryptography.
AskRequest the server configuration files or settings for the web servers and database servers.Look atCheck that encryption is enabled for the communications between the web and database tiers.GoodActive encryption settings that match ASD-approved cryptography, with no unencrypted fallback.
AskAsk to see records of staff training sessions about data encryption.Look atLook for attendance records and the training materials used.GoodRecent training that is relevant to encrypting database and web server communications.
AskRequest logs confirming regular checks of the encryption protocols in use.Look atEnsure the logs show checks are being performed and that any issues are resolved promptly.GoodFew, if any, unaddressed issues remaining in the logs.
AskAsk for details of the encryption certificate management process.Look atLook at certificate expiry dates and how renewal is managed.GoodA process with reminders for renewal well before expiry dates, so encryption is never interrupted.

04 - Mappings

link

Cross-framework mappings

How ISM-1277 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 5.14	ISM-1277 requires that data communicated between database servers and web servers is encrypted to protect it in transit
Annex A 8.24	ISM-1277 requires encryption of data in transit specifically between web servers and database servers