ASD ISM 1439 Restrict IP disclosure in CDNs
What it says
If using CDNs, disclosing the IP addresses of web servers under an organisation's control (referred to as origin servers) is avoided and access to the origin servers is restricted to the CDNs and authorised management networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAvoid sharing web server IPs and limit access to them by CDNs and authorised networks for security.
This control is about making sure only certified networks, like Content Delivery Networks (CDNs), know the IP addresses of your web servers. If these IP addresses get into the wrong hands, cyber attackers could bypass your security and directly attack your servers.
Free. Save your status, tasks and notes.
Why it matters
Exposing origin server IPs enables attackers to bypass CDN protections, directly target the origin, and cause outages or data compromise.
How to implement
The IT team should configure the web server settings to hide the server's IP addresses from the public.
They can do this by using tools that mask the IP and ensure only the CDN has access to it.
Network administrators should set up firewall rules to restrict access to the servers.
Only the CDN's range of IP addresses and any other authorised networks should be allowed through.
Security managers should regularly review who can access the web servers.
They need to ensure that only authorised personnel and CDNs have IP access, updating these permissions regularly.
Web developers should use the features of CDNs that help secure IP addresses from being disclosed, such as IP masking or proxy settings offered by the CDN service.
The operations team should train staff on why keeping web server IPs secret is essential.
This can include security awareness sessions explaining how revealing these IPs can lead to potential risks.
Keep it running
Maintain allowlists so origin servers only accept traffic from CDN egress IP ranges and authorised management networks; review and update rules when CDN IPs change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network access control list: Request the document showing which IPs are allowed to access the web servers.
Look at
IP ranges that match only the CDN and authorised networks.
Good evidence
Should not include any unauthorised IP addresses.
- Check 2 of 5What an auditor asks for
Ask for
Policies that outline how IP addresses are concealed and restricted.
Look at
Evidence of implementation steps and responsibilities.
Good evidence
Is a detailed procedure document with clear steps and assigned roles.
- Check 3 of 5What an auditor asks for
Ask for
Logs of server access attempts: Request logs that show who has tried to connect to the servers.
Look at
Dates, times, and source IPs of access attempts.
Good evidence
Shows only access from the CDN and authorised partners.
- Check 4 of 5What an auditor asks for
Ask for
A demonstration of the firewall settings on relevant servers.
Look at
The list of IPs allowed to pass through the firewall.
Good evidence
Shows that only authorised IP ranges are present.
- Check 5 of 5What an auditor asks for
Ask for
To see any security incident reports involving IP exposure: Request documents or reports concerning past incidents related to IP address exposure.
Look at
Incidents involving unauthorised access or data breaches.
Good evidence
Shows that no such incidents have occurred, or if they have, how they were resolved and prevented from recurring.
Mappings
Closest match in ISO/IEC 27001: A.8.3, Restrict access to information and assets, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.8.3.
ISM-1439 requires restricting access to origin web servers so only CDNs and authorised management networks can reach them, and avoiding disclosure of the origin IPs. ISO/IEC 27001 Annex A 8.3 is broader, requiring access to information and associated assets to be restricted according to policy, which would include network-layer restrictions protecting origin servers. ISM-1439 adds CDN-specific exposure and network allow-list requirements that are not explicitly called out in Annex A 8.3.
This control partially meets A.8.20.
ISM-1439 focuses on protecting origin servers behind CDNs by preventing IP disclosure and enforcing network access restrictions to only the CDN and authorised management networks. ISO/IEC 27001 Annex A 8.20 covers securing and controlling networks and network devices generally, which includes firewalling, ACLs, routing controls, and exposure management needed to enforce origin-only-from-CDN connectivity. ISM-1439 is a specific pattern within the broader network security management expectations of Annex A 8.20.
This control partially meets A.8.22.
ISM-1439 requires organisations using CDNs to avoid disclosing origin server IP addresses and to restrict origin access to the CDN and authorised management networks. ISO/IEC 27001 Annex A 8.22 relates by requiring network segregation, which is commonly implemented by isolating origin servers into dedicated segments reachable only from CDN egress and tightly controlled management subnets. ISM-1439 is a specific CDN/origin hardening use case, while Annex A 8.22 is broader network zoning across all services.
This control depends on A.5.15.
ISM-1439 requires a defined approach to preventing origin IP disclosure and restricting origin server access to CDNs and authorised management networks. ISO/IEC 27001 Annex A 5.15 provides the overarching access control rules and procedures that set the basis for defining which networks (CDN egress and management) are permitted to access origin servers. Without Annex A 5.15-style policy and procedures, implementing and consistently enforcing ISM-1439's network restrictions is less defensible and repeatable.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.