ASD ISM 1385 Segregation of administrative infrastructure from networks
What it says
Administrative infrastructure is segregated from the wider network and the internet.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAdministrative systems are isolated from the main network and internet to enhance security.
This control means keeping the systems that manage your organisation's infrastructure separate from the regular office network and the internet. It's important because if these critical systems are compromised, hackers could gain control over your essential operations, leading to data breaches or disruptions.
Free. Save your status, tasks and notes.
Why it matters
If administrative infrastructure is not segregated from the wider network and internet, attackers can reach privileged management systems and pivot into production to disrupt services or exfiltrate sensitive data.
How to implement
IT manager: Separate the network for administrative tasks by building a dedicated network or server that is only used for these activities.
This can be done by setting up a separate physical or virtual network that does not connect to the regular networks or the internet.
System administrator: Ensure access to the administrative network is restricted to only authorised personnel.
Set up strict user permissions and ensure that only essential staff have the credentials necessary to access these systems.
IT support staff: Use secure methods to connect to the administrative network.
Implement a virtual private network (VPN) or direct physical access where necessary, ensuring any remote access is secure and logged.
Security officer: Conduct regular audits and scans of the administrative network to identify any vulnerabilities or unauthorised access attempts.
Use security tools to perform these checks and review logs regularly.
Office manager: Ensure any devices that connect to the administrative network are not used for other internet activities.
This includes dedicating specific workstations or laptops solely for administrative tasks, reducing the risk of malware from downloaded files or websites.
Keep it running
Verify admin segments are isolated via VLANs/routing and strict firewall ACLs; require access via a hardened jump host; confirm no direct internet connectivity or unintended cross-network routes exist.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Network topology diagrams: Request a diagram showing how the administrative infrastructure is separated from other networks.
Look at
Clear delineation between the administrative network and others.
Good evidence
The diagram clearly shows a dedicated administrative network that is not directly accessible from the internet or office network.
- Check 2 of 5What an auditor asks for
Ask for
Access control policies: Check for documented procedures around who has access to the administrative network.
Look at
Role-based access permissions and an approvals process.
Good evidence
Access policies list authorised personnel, define their access levels, and include an approvals process with periodic reviews.
- Check 3 of 5What an auditor asks for
Ask for
Logs of access to the administrative network: Request logs showing who accessed the network and when.
Look at
Timestamped entries showing limited, authorised access.
Good evidence
Logs indicate access is restricted to authorised users and contain no unauthorised access attempts.
- Check 4 of 5What an auditor asks for
Ask for
Security scan reports: Request reports from recent security audits or vulnerability scans of the administrative network.
Look at
Identified issues and mitigation actions taken.
Good evidence
Reports show regular scans conducted with issues promptly addressed and documented fixes.
- Check 5 of 5What an auditor asks for
Ask for
Training records: Request records of training provided to staff who maintain or use the administrative network.
Look at
Courses or materials related to secure handling and access procedures.
Good evidence
Training records show all staff with administrative access have completed security training within the last year.
Mappings
Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.22.
Annex A 8.22 requires segregating groups of systems, services and users within organisational networks to limit compromise spread and constrain access paths. ISM-1385 relates by mandating segregation of administrative infrastructure from the wider network and the internet, which is a key instance of segregating a high-trust management network from lower-trust zones. ISM-1385 is narrower (admin infrastructure specific) while Annex A 8.22 is broader and applies to any network grouping.
ASD Essential Eight: 2 mappings
- E8-RA-ML1.3Prevent privileged user accounts from accessing internet, email and web servicesPartially overlaps
This control partially overlaps E8-RA-ML1.3.
E8-RA-ML1.3 requires privileged accounts to be prevented from accessing internet, email, and web services, reducing compromise pathways. ISM-1385 supports this by requiring administrative infrastructure segregation from the wider network and the internet, facilitating technical enforcement of the prohibition for admin accounts and workstations. ISM-1385 focuses on network architecture segregation, while E8-RA-ML1.3 focuses specifically on account-usage restriction online.
This control partially overlaps E8-RA-ML3.2.
E8-RA-ML3.2 requires administrative activities to be performed only from Secure Admin Workstations (SAWs). ISM-1385 requires administrative infrastructure to be segregated from the wider network and the internet, which materially strengthens the security posture of SAWs and privileged administration workflows. The controls address different layers (endpoint usage vs network/infrastructure segregation), but ISM-1385 helps make the SAW model in E8-RA-ML3.2 effective in practice.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-05.1Restrict administration to dedicated, hardened environments isolated from unprivileged user workloadsPartially overlaps
This control partially overlaps IT.PRO-05.1.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; ISM-1385 requires administrative infrastructure to be segregated from the wider network and the internet, overlapping on isolation at the network level.
- IT.PRO-18.1Isolate systems in criticality- and trust-based network zones with approved, monitored pathwaysPartially overlaps
This control partially overlaps IT.PRO-18.1.
IT.PRO-18.1 requires systems to be isolated in network zones by criticality and trust level, with access restricted to approved pathways; ISM-1385 requires administrative infrastructure to be segregated from the wider network and the internet, one case of that isolation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.