ASD ISM 1436 Segregate critical services to prevent DoS attacks
What it says
Critical online services are segregated from other online services that are more likely to be targeted as part of denial-of-service attacks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCritical online services are kept separate to reduce the risk of service disruption from attacks.
This control is about keeping your most important online services separate from others to reduce the risk of them being disrupted by denial-of-service (DoS) attacks. These attacks can overwhelm your system, like a traffic jam clogging a road, preventing legitimate users from accessing your service. By segregating critical services, you minimise the chances of key parts of your business getting caught up in such disturbances.
Free. Save your status, tasks and notes.
Why it matters
Without segregation, DoS attacks on exposed services can also disrupt critical online services, causing outages.
How to implement
The IT team should review all online services to identify which are critical for business operations.
Start by listing every service you rely on digitally and assess which ones are essential for day-to-day activities. Those identified as critical need to be earmarked for segregation.
The system administrator needs to set up separate networks for critical services.
This can be done by configuring different network segments or using virtual local area networks (VLANs) to isolate them from less critical systems.
Business managers should work with the IT team to establish clear priorities for the services.
Define what services are most critical to everyday operations and ensure these are top of the list for protection and segregation.
The IT team should implement monitoring to ensure that non-critical service disruptions do not affect critical services.
Use basic monitoring tools to check if one part of your network is experiencing unusual traffic spikes that could indicate an attack.
System owners should regularly review the separated setup to confirm it is effective.
Schedule routine checks, perhaps monthly or quarterly, to ensure the critical services remain properly segregated and adjust setups as changes in service use occur.
Keep it running
Periodically validate segmentation rules so critical services remain isolated from DoS-prone public-facing systems.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network diagram: Request a visual map showing how the organisation's network is divided, particularly focusing on critical and non-critical services. Look to see that critical services are clearly segmented from less essential ones.
Good evidence
Is a clear diagram with labelled segments distinguishing between critical and non-critical services.
- Check 2 of 5What an auditor asks for
Look at
Evident criteria that justify each service's categorisation as critical.
Good evidence
Is a well-documented list with justification notes from business leaders or system owners.
- Check 3 of 5What an auditor asks for
Ask for
To see the security configurations: Request evidence of security settings that ensure separate critical pathways.
Look at
Firewall rules or network access control lists.
Good evidence
Is records showing specific settings that prevent non-critical service disruptions from spilling over.
- Check 4 of 5What an auditor asks for
Ask for
Recent reports from network monitoring tools that track current and past disruptions or significant traffic patterns.
Look at
Indications of separate monitoring for critical services.
Good evidence
Is logs showing specific attention to critical services and historical records of traffic.
- Check 5 of 5What an auditor asks for
Ask for
To review policy documents: Request the policy or procedure documents that describe how services are categorised and segregated.
Look at
Sections describing the rationale behind the separation.
Good evidence
Includes detailed processes and named staff or teams responsible for maintaining segregation.
Mappings
Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.22.
ISM-1436 requires critical online services to be segregated from other online services that are more likely to be targeted by denial-of-service (DoS) attacks, reducing the likelihood that an attack on one service disrupts another. Annex A 8.22 requires network segregation of groups of information services, users, and information systems, providing the general mechanism (segmented network zones) that can be applied to isolate critical services from higher-risk/public-facing services. ISM-1436 is a specific, DoS-driven instance of the broader network segregation requirement in Annex A 8.22.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.