ASD ISM 1428 Disable IPv6 tunnelling unless necessary
What it says
Unless explicitly required, IPv6 tunnelling is disabled on all network devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIPv6 tunnelling on network devices should be disabled unless absolutely needed.
This control is about turning off a technology feature called 'IPv6 tunnelling' in your network devices unless you really need it. Imagine it as a back door to your network; if left open unnecessarily, it could let bad actors sneak in unnoticed. It's important to keep your digital doors locked to protect sensitive information and keep your business operations running smoothly.
Free. Save your status, tasks and notes.
Why it matters
If IPv6 tunnelling is left enabled, attackers can bypass IPv4 security controls and monitoring, enabling unauthorised access or data exfiltration.
How to implement
IT team should identify if IPv6 tunnelling is being used: Conduct a thorough network inventory to check if any devices are currently using IPv6 tunnelling features.
Use network management tools to list devices and their configurations.
IT manager should review necessity: Assess the business or operational need for IPv6 tunnelling on specific devices.
Talk to key business units to understand if any applications or services require this feature.
Network administrator to disable non-essential tunnelling: For devices where IPv6 tunnelling is not required, switch it off in the device settings.
Use device management software to apply these settings across the network.
System owner to communicate with stakeholders: Inform any relevant stakeholders, such as department managers, about the changes and why they are necessary for security.
Ensure they understand the impact, if any, on their operations.
IT team should schedule regular reviews: Set up a routine check (e.g., every 6 months) to ensure that IPv6 tunnelling remains disabled on devices unless expressly needed.
Use network monitoring systems to flag any unauthorised reactivation.
Keep it running
Confirm IPv6 tunnelling (e.g. 6to4, Teredo, ISATAP) is disabled on routers, firewalls and hosts; only enable via approved change and re-check configs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Network configuration records: Request documents showing current settings of network devices.
Look at
Lists showing which devices have tunnelling enabled.
Good evidence
Records show tunnelling disabled except where justified.
- Check 2 of 5What an auditor asks for
Ask for
A needs assessment report: Request a report detailing why any devices have IPv6 tunnelling enabled.
Look at
The business justification provided.
Good evidence
Each enabled device has a clear, justified business need documented.
- Check 3 of 5What an auditor asks for
Ask for
To see a stakeholder communication log: Request evidence of communications to stakeholders about this change.
Look at
Emails or memos detailing the change.
Good evidence
Documented communication to all relevant parties with confirmation receipts.
- Check 4 of 5What an auditor asks for
Ask for
Device management tool reports: Request a report from any tools used to manage device configuration centrally.
Look at
Deployment logs confirming settings were applied.
Good evidence
Logs show successful disabling of tunnelling on all applicable devices.
- Check 5 of 5What an auditor asks for
Ask for
Policy or procedure documents: Request any policy documents related to network configuration.
Look at
Clear directives on disabling tunnelling unless needed.
Good evidence
Policy specifically highlights IPv6 tunnelling settings with enforcement mechanisms.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
ISM-1428 mandates a specific secure configuration setting: IPv6 tunnelling is disabled unless needed. This maps to ISO/IEC 27001:2022 Annex A 8.9 because the tunnelling setting is part of establishing, documenting, implementing, monitoring and reviewing security configurations for networks and network devices. Annex A 8.9 covers the full configuration management lifecycle for all technologies, whereas ISM-1428 is a single prescriptive configuration control.
This control partially meets A.8.20.
Annex A 8.20 requires secure management of networks and network devices to reduce opportunities for unauthorised access and data compromise. ISM-1428 supports this by requiring IPv6 tunnelling to be disabled unless explicitly required, reducing covert channels and bypass routes around security controls. Annex A 8.20 is broader as it covers end-to-end network security controls beyond the specific topic of IPv6 tunnelling.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.