ASD ISM 1416 Implement firewalls to control network connections
What it says
A software firewall is implemented on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse software firewalls to control what apps and services can connect to your network.
Implementing software firewalls on computers and servers helps keep unwanted connections out and controls what applications can access your network. This is important because it stops hackers or harmful programs from sneaking in and causing damage or stealing information.
Free. Save your status, tasks and notes.
Why it matters
Poor firewall implementation can allow unauthorised applications to access sensitive data, increasing the risk of data breaches and compromises.
How to implement
IT team should install and configure a software firewall on each company computer and server.
This can be done by following the setup instructions provided by the firewall software, ensuring that they allow only approved applications to communicate through the network.
System administrators should regularly review the list of allowed applications on the firewall.
They can do this by accessing the firewall settings periodically and confirming with department heads that only necessary applications are enabled.
Managers should coordinate with the IT team to set up a policy for approving new applications.
This involves creating a simple form for staff to request network access for new applications and reviewing these requests monthly.
The security officer should conduct training sessions for employees about the importance of network security.
Use easy-to-understand examples about why only approved applications should be used and how to recognise potential threats.
Procurement should ensure that any new software or applications purchased for the organisation are assessed by the IT team for compatibility with the existing firewall settings.
This means communicating with vendors about any special network requirements before purchase.
Keep it running
Maintain an up-to-date allowlist for inbound/outbound rules, enforce default-deny, and routinely verify workstation/server firewall policies match approved apps/services.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The firewall configuration report: Request a document or screenshot that shows current firewall settings on a workstation and server.
Look at
The list of allowed applications and network rules.
Good evidence
Only necessary and approved applications should be listed, with clear reasons for each one.
- Check 2 of 5What an auditor asks for
Ask for
To see the policy for approving new applications: Request the written policy that outlines how new applications are assessed before being approved for network access.
Look at
Clear steps in the decision-making process.
Good evidence
The policy includes IT team review, manager approval, and a documented application list update.
- Check 3 of 5What an auditor asks for
Ask for
Records of recent firewall reviews: Request evidence of the last review conducted by the IT team.
Look at
The dates and any changes made based on the review.
Good evidence
Reviews are carried out regularly (e.g., quarterly), and any changes are documented with reasons.
- Check 4 of 5What an auditor asks for
Ask for
How staff are trained on network security: Request details of training sessions or workshops held for employees.
Look at
Attendance records and topics covered.
Good evidence
Regular sessions with clear explanations on using only approved applications and identifying threats are carried out, and most staff attend.
- Check 5 of 5What an auditor asks for
Ask for
About the procedure for handling unauthorised applications: Request documentation on steps taken if an unauthorised application is identified.
Look at
A clear, responsive plan involving the IT team and managers.
Good evidence
The procedure stops an unauthorised application immediately, investigates its source, and updates future access policies.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1416 requires software firewalls on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include host-based firewalling as a key technical measure. Annex A 8.20 is broader (covering network devices, monitoring and management), while ISM-1416 is a specific control mechanism focused on workstation/server software firewalls and application/service allow-listing for connections.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.