ASD ISM 1311 Prevent use of insecure SNMP versions on networks
What it says
SNMP version 1 and SNMP version 2 are not used on networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAvoid using SNMP versions 1 and 2, as they are insecure for network management.
This control is about ensuring that your network doesn't use old, unsafe methods to manage devices, specifically versions 1 and 2 of something called the Simple Network Management Protocol (SNMP). If these outdated versions are used, hackers can easily snoop on or change your network data, leading to information theft or network disruption.
Free. Save your status, tasks and notes.
Why it matters
If SNMPv1/v2 are used, attackers can sniff community strings and modify device settings via unauthenticated or weakly protected SNMP traffic.
How to implement
IT support should review network management software to ensure it only uses SNMP version 3.
This involves checking the software settings and configurations to see if older versions are disabled.
The network administrator should conduct a survey of all devices on the network to identify which ones still use SNMP versions 1 or 2.
Use a network scanning tool to find these devices, and record the findings for action.
Procurement should stipulate in contracts with IT suppliers that any new management systems must not use SNMP versions 1 or 2.
This can be done by including clear language in the purchase agreement stating the requirement.
Managers should organise training sessions for their IT staff on the importance of using SNMP version 3.
Provide materials or bring in an expert to explain why upgrading is crucial for network security.
The IT team should regularly update device firmware and software to support the secure SNMP version 3.
Follow manufacturer instructions for upgrading and verify that SNMP v3 features are enabled post-update.
Keep it running
Scan and audit network devices to confirm SNMPv1/v2 are disabled; allow only SNMPv3 with authentication and encryption, and remove legacy configs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network configuration documentation: Request details on current network management settings.
Look at
Whether SNMP versions 1 and 2 are mentioned anywhere.
Good evidence
Is documentation clearly showing only version 3 being configured.
- Check 2 of 5What an auditor asks for
Ask for
A recent network device inventory: Check for any devices listed as using SNMP v1 or v2.
Look at
All listed devices showing they use SNMP v3 instead.
Good evidence
An inventory showing no devices with outdated SNMP versions.
- Check 3 of 5What an auditor asks for
Ask for
The IT procurement policy: Check for clauses ensuring new devices or software do not support SNMP v1 or v2.
Look at
Whether the policy requires version 3 as standard.
Good evidence
A policy document stating SNMP v3 is a requirement.
- Check 4 of 5What an auditor asks for
Ask for
To see the IT team's training records.
Look at
The list of completed sessions and attendance. Check if training covered SNMP security practices.
Good evidence
Dated records showing staff attended training about SNMP version use.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of firmware and software updates: This includes logs or reports on updates aimed at enabling SNMP v3.
Look at
The update history and completion details.
Good evidence
Comprehensive logs showing recent updates which ensure SNMP v3 is enabled.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-1311 mandates that organisations ensure SNMP version 1 and 2 are not used on networks. Annex A 8.9 deals with configurations (including security configurations) of networks and services to be established, implemented, monitored, and reviewed. This includes configuring network devices to use only secure SNMP versions (e.g., SNMPv3) or disabling SNMP. Annex A 8.9 is broader as it applies to all configuration items and security settings, not just SNMP.
This control partially meets A.8.20.
ISM-1311 requires organisations to prevent the use of insecure SNMP versions (SNMPv1 and SNMPv2) on networks. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which would include enforcing secure management protocols and disabling weak ones such as SNMPv1/v2. Annex A 8.20 is broader because it encompasses overall network/device security beyond SNMP protocol version selection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.