ASD ISM 1521 Use protocol breaks to separate network layers
What it says
CDSs implement protocol breaks at each network layer.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure data flows are separated by breaking protocols at each network level for security.
This control is about making sure that the flow of data through different networks has breaks between each layer. Think of it like having walls between rooms in your house to keep each section private and secure. If you don't have these breaks, sensitive information could leak from one network area to another, creating a risk of data breaches.
Free. Save your status, tasks and notes.
Why it matters
Without protocol breaks between network layers, traffic can traverse unintended paths, enabling cross-layer data leakage and raising the likelihood of compromise.
How to implement
IT team should identify where data crosses from one network to another within the organisation.
They can do this by mapping out the data paths and points where different network systems connect, using simple diagrams or lists.
System administrators should set up protocol breaks at these identified crossing points.
This involves creating a separate point where data from one network is checked and possibly transformed into a different format before it continues to the next network layer.
Managers should ensure the protocol break systems have regular checks by IT staff.
They can set up a schedule for these checks, ensuring the security settings are up-to-date and functioning as intended.
Security officers should conduct training sessions for staff about the importance of protocol breaks.
The training should include what protocol breaks are and why they are critical for safeguarding sensitive data.
System owners should work with IT teams to document the areas where protocol breaks are implemented.
They need to create a clear document that lists these points and describes how each break functions to maintain security.
Keep it running
Regularly verify protocol breaks at each network layer (e.g., gateways/guards), review boundary rules, and monitor for misconfigurations that enable unintended cross-layer flows.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network diagram showing protocol breaks: Request the current network diagram that includes marked points of protocol breaks.
Look at
Where these breaks are integrated within the network diagram.
Good evidence
A diagram with distinct, labelled protocol break points across different network layers.
- Check 2 of 5What an auditor asks for
Ask for
To see the documentation on protocol break procedures: Request documents detailing how data is processed at each protocol break.
Look at
Steps that describe how data is checked or changed before it moves to the next network layer.
Good evidence
Comprehensive instructions for each break point, including any transformation or checks done.
- Check 3 of 5What an auditor asks for
Ask for
Logs of regular protocol break checks: Request the records showing when and how often the protocol breaks are checked.
Look at
Consistent entries in the logs with descriptions of what was checked and any issues found.
Good evidence
Logs with regular dates and clear descriptions of the monitoring activities.
- Check 4 of 5What an auditor asks for
Ask for
To review staff training records on protocol breaks: Request records or certificates of staff training sessions about protocol breaks.
Look at
Attendance records and training content.
Good evidence
Documented evidence of regular training sessions with high staff attendance.
- Check 5 of 5What an auditor asks for
Ask for
System configuration settings: Request access to configuration settings where protocol breaks are enforced.
Look at
The technical parameters and ensure they align with the documented procedures.
Good evidence
Configuration settings align exactly with documented procedures and show evidence of regular updates.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1521 requires CDSs to implement protocol breaks at each network layer to enforce strong separation of data flows between layers. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include using architectural patterns such as protocol breaks on gateways and boundary devices. Annex A 8.20 is broader and technology-agnostic, while ISM-1521 is a specific CDS design requirement focused on layered protocol separation.
This control depends on A.8.22.
ISM-1521 requires CDSs to implement protocol breaks at each network layer to prevent direct end-to-end protocol continuity and reduce cross-layer or cross-domain attack paths. ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of services, users and systems in organisational networks, typically via zoning, VLANs, firewalls and routing controls. Protocol breaks can strengthen segregation by ensuring transitions between zones/layers are mediated and re-terminated, but Annex A 8.22 does not require protocol breaks specifically.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.