ASD ISM 1432 Protect online services from domain hijacking
What it says
Domain names for online services are protected via registrar locking and confirming that domain registration details are correct.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure online service domain security by locking registration and verifying details.
This control is about making sure your online business or service stays under your control, avoiding a situation where someone else takes over your domain name. Imagine if someone hijacked your website's address; customers could be misled, and your reputation could be damaged. It's important to lock your domain and confirm all registration details to prevent this from happening.
Free. Save your status, tasks and notes.
Why it matters
Without registrar lock and accurate registrant details, attackers can hijack domains, redirect users to fake sites, and damage trust and revenue.
How to implement
Domain owners should work with their domain registrar to enable domain locking.
This process usually involves logging into your account with the domain registrar and activating a specific locking feature that prevents unauthorised changes.
The financial manager or business owner should make sure all contact and payment details for domain registration are up-to-date.
This includes checking the primary contact email address is one that is monitored regularly and updating any payment information promptly.
The IT manager or website administrator should schedule regular audits of domain registration details.
This involves setting a calendar reminder each quarter to log in to the domain registrar's portal and verify that all information is correct and hasn't been altered.
Business owners should use multi-factor authentication (MFA) for accessing domain registrar accounts.
This requires using an extra security step, like a phone app or physical token, along with a password to ensure that no one but authorised personnel can access the account.
Procurement should keep a record of all communication and contracts with the domain registrar.
Ensure there's a clear document trail that includes confirmations of domain locking and any recent updates to account details.
Keep it running
Enable registrar lock, restrict registrar account access, and regularly verify registrant/admin contact details and DNS settings match expected values.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A recent domain registration record: Request the document or screenshot showing the current registered details.
Look at
The registered owner's name, contact email, and last updated date.
Good evidence
Includes updated contact details and a recent date indicating regular review.
- Check 2 of 5What an auditor asks for
Ask for
A domain lock confirmation: Request evidence, like an activation email or screenshot from the domain registrar, showing that domain locking is enabled.
Look at
Clear indication that the feature is active.
Good evidence
Is a confirmation showing domain lock is on.
- Check 3 of 5What an auditor asks for
Ask for
Logs of domain access: Request logs or records that indicate who accessed the domain settings and when.
Look at
Entries showing the last access and any changes.
Good evidence
Contains logs showing regular checks with no unauthorised changes.
- Check 4 of 5What an auditor asks for
Ask for
To see the MFA configuration for the domain account: Request evidence that multi-factor authentication is set up for the account login.
Look at
Enabled status and enrolled devices.
Good evidence
Includes screenshots or emails confirming MFA setup.
- Check 5 of 5What an auditor asks for
Ask for
Communication history with the domain registrar: Request emails, support tickets, or other records showing interaction with the registrar.
Look at
Discussions about domain locking and recent updates.
Good evidence
Contains clear communication about domain security.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.15.
ISM-1432 requires organisations to protect online service domain names by using registrar locking and confirming domain registration details are correct. Annex A 5.15 requires establishing and implementing rules to control logical access to information and associated assets, which can include controlling access to domain registrar accounts and DNS management portals. ISM-1432 is a specific, domain-hijacking-focused implementation, whereas Annex A 5.15 is a broader access control policy and procedure requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.