ASD ISM 1386 Restrict network management traffic origin
What it says
Network management traffic can only originate from administrative infrastructure.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly authorised admin systems should manage network settings, ensuring security and control.
This control means that only certain computers or systems that have been approved can make changes to your network settings. This is important because if anyone could change these settings, it could lead to unauthorised access or disruptions in your services, causing potential harm to your business operations.
Free. Save your status, tasks and notes.
Why it matters
If network management traffic can originate from non-admin systems, attackers can gain device control, change configs, and disrupt routing/switching services.
How to implement
IT team should designate specific computers or devices for network management tasks.
They can do this by creating a list of approved devices and ensuring only these devices have the necessary software to access network settings.
System administrators must ensure only authorised personnel use the designated devices.
They can achieve this by setting up secure logins on these devices and training staff on proper usage protocols.
Network managers should regularly update and review permissions for accessing management devices.
They can do this by checking who is on the access list every quarter and removing anyone who no longer needs access.
IT staff should install and maintain security software on all admin systems.
This could involve installing antivirus programs and enabling firewalls to protect these systems from external threats.
Managers should enforce strict policies on where and how admin systems are used.
They should ensure that these devices are only used in secure, controlled environments and not for general internet browsing.
Keep it running
Allow management protocols only from admin hosts/subnets (e.g., jump hosts) via ACLs and mgmt VLANs; block all other sources and log attempts.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of designated admin systems.
Look at
Whether it includes specific device names and user authorisations.
Good evidence
List is up-to-date with clear, specific entries that match organisational needs.
- Check 2 of 5What an auditor asks for
Good evidence
Log will clearly show authorised access with timestamps and user identities.
- Check 3 of 5What an auditor asks for
Look at
The content and completion dates of training programs. Good training records show regular, up-to-date training with a clear focus on network management security.
- Check 4 of 5What an auditor asks for
Ask for
The security configuration of admin systems. Review software versions and security settings recorded.
Good evidence
Configuration would be current with all necessary security features enabled and documented.
- Check 5 of 5What an auditor asks for
Look at
Clear guidelines on acceptable use and security measures.
Good evidence
Policy is comprehensive, outlining specific procedures for staff to follow.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1386 requires that network management traffic can only originate from authorised administrative infrastructure. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which includes restricting who/what can administer network devices and from where. ISM-1386 is a specific technical restriction within the broader network security and management expectations of Annex A 8.20.
This control partially overlaps A.8.22.
ISM-1386 requires that network management traffic can only originate from administrative infrastructure. ISO/IEC 27001:2022 Annex A 8.22 requires network segregation, which commonly includes separating management networks from user networks and constraining management-plane access to specific segments. ISM-1386 is more specific about the allowed origin of management traffic, whereas Annex A 8.22 is broader and covers segregation across many service/user/system groupings beyond management traffic.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.