ASD ISM 1364 Separate VLANs by security domains
What it says
Network devices managing VLANs terminate VLANs belonging to different security domains on separate physical network interfaces.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure VLANs from different security domains use separate network interfaces to avoid cross-traffic.
When you're organising your computer network, imagine it like different sections in a department store. This control is about ensuring each section (or VLAN) is kept on its own floor, preventing items (or data) from accidentally ending up in the wrong place. This matters because if sections aren't kept separate, sensitive information can accidentally end up where it shouldn't, leading to data breaches and potential legal troubles.
Free. Save your status, tasks and notes.
Why it matters
Without separate physical interfaces per security domain, VLAN termination can allow unintended inter-domain routing, increasing risk of data leakage.
How to implement
IT manager: Identify the different security domains within your organisation.
Security domains are like different departments in an office, each with its own types of data that need protection from others. List these domains and assess which areas of your network they use.
Network administrator: Configure each VLAN for different security domains to run on separate network interfaces.
This is like dedicating a specific lane to each type of traffic on a highway, ensuring there's no crossover that could cause confusion or accidents.
IT team: Conduct regular reviews of the network setup.
Check that no changes have merged VLANs that should be separate. Use network management tools to verify that all VLAN configurations still meet the security domain separations.
Procurement officer: Ensure that when new networking equipment is purchased, it supports multiple physical network interfaces.
This way, new devices can maintain the separation required between different security domains.
Security officer: Educate staff about the importance of keeping network segments separate.
Use simple examples, likening it to keeping work files in separate, labelled cabinets so nothing is misplaced or mistakenly accessed by the wrong people.
Keep it running
Confirm VLANs for different security domains are terminated on separate physical interfaces; review trunks/SVIs and change records to prevent shared termination.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network architecture diagram: Request the most up-to-date diagram showing how VLANs are structured and connected.
Look at
The separation of different security domains onto distinct network interfaces.
Good evidence
Is seeing a clear visual separation with no overlap between sensitive and regular data traffic.
- Check 2 of 5What an auditor asks for
Ask for
The VLAN configuration policy: Request the policy document that outlines how VLANs should be set up.
Look at
The rules for assigning VLANs to network interfaces and any exceptions noted.
Good evidence
Will describe specific rules for separation aligned with organisational security domains.
- Check 3 of 5What an auditor asks for
Ask for
To review recent network logs: Request logs from the network management system showing the current network setup and recent changes.
Look at
Logs detailing which VLANs are assigned to which network interfaces.
Good evidence
Shows logs matching the policy with no unauthorised changes.
- Check 4 of 5What an auditor asks for
Ask for
Staff training records: Check documentation of any training given on network security relevant to VLAN management.
Look at
Who attended the training and the topics covered.
Good evidence
Includes regular sessions on VLAN separation and evidence that key IT staff attended.
- Check 5 of 5What an auditor asks for
Ask for
To see the equipment purchase records: Request records for recent networking equipment purchases.
Look at
Specifications showing hardware with enough interfaces to maintain needed separations.
Good evidence
Shows purchases aligned with strategic network design goals, supporting multiple VLAN separations.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1364 addresses a specific network-device configuration requirement: VLANs for different security domains must terminate on separate physical interfaces. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed, and controlled to protect information, which includes secure configuration of switching, trunking, and interface design. ISM-1364 fits within Annex A 8.20 as a concrete control for reducing cross-domain exposure, but Annex A 8.20 also covers many other network-device security aspects beyond VLAN termination.
This control partially meets A.8.22.
ISM-1364 requires VLANs from different security domains to be terminated on separate physical network interfaces to prevent cross-domain traffic mixing. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation of services, users, and systems, which commonly includes segmentation using VLANs, routing/firewall boundaries, and physical separation. ISM-1364 is a specific technical implementation pattern for segregation (physical interface separation for VLAN termination), whereas Annex A 8.22 is broader and technology-agnostic about how segregation is achieved.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.