ASD ISM 1522 Ensure CDSs separate upward and downward data paths
What it says
CDSs implement independent security-enforcing functions for upward and downward network paths.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCDSs have independent security controls for data going both up and down between networks.
A Cross Domain Solution (CDS) ensures that when information is sent between different networks, the path for sending information from a less sensitive network to a more sensitive one is kept separate from the path going in the opposite direction. This is important because mixing these paths could allow unauthorised access to sensitive information or cause data leaks, similar to leaving a door unlocked for outsiders to slip in unnoticed.
Free. Save your status, tasks and notes.
Why it matters
Improper separation can allow cross-domain leakage or a bypass, enabling data exfiltration downward or compromise of high-side networks via the wrong path.
How to implement
System owners should ensure that their networks have separate paths for sending and receiving data.
They can do this by consulting with a security expert to create clear flow paths in the network design, specifically for handling different levels of sensitive data.
IT teams need to implement and maintain separate technology controls for each data path.
They can achieve this by using network configurations that distinctly separate the routing of 'upward' (less to more sensitive) and 'downward' (more to less sensitive) data flows, ensuring no overlap.
Managers should regularly train their staff on the importance of these separations.
This can be achieved through workshops or e-learning modules that explain the separation concept in practical terms for everyday activities.
Procurement officers must acquire and maintain the right tools and technologies that enforce these separations.
They should work with vendors to ensure that products purchased have features that support separation of data flows according to Australian Cyber Security Centre (ACSC) guidelines.
Policies should be put in place by governance teams to ensure compliance with this control.
These policies should clearly document the need for separation, and regular internal audits should verify adherence to these policies and the effectiveness of the separation.
Keep it running
Regularly confirm CDSs enforce separate, independent security functions for upward and downward paths, and test that failures in one path cannot affect the other.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network design documents: Request diagrams and descriptions detailing how data flows between networks are managed.
Look at
Whether these documents distinctly outline upward and downward paths.
Good evidence
Shows clear, separate paths for each direction with documented security controls.
- Check 2 of 5What an auditor asks for
Look at
Documentation that indicates compliance with the dual-path requirement.
Good evidence
Provides logs with timestamps verifying that information flows separately through designated paths.
- Check 3 of 5What an auditor asks for
Look at
Whether staff received specific instructions about CDS and data path separation.
Good evidence
Includes attendance logs or certificates showing all relevant staff attended recent training sessions.
- Check 4 of 5What an auditor asks for
Ask for
System configuration settings: Request access to actual network configurations or screenshots showing CDS settings. Check for settings that enforce the separation of data paths.
Good evidence
Is explicit settings in network management systems that enforce path separation requirements.
- Check 5 of 5What an auditor asks for
Ask for
Records showing which tools and technologies are authorised for ensuring path separation.
Look at
Their features compared to the requirement for independent paths.
Good evidence
Provides evidence that technologies used have been vetted for compliance with the separation requirement.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.20.
ISM-1522 requires CDSs to enforce security independently on upward and downward transfer paths to prevent cross-domain leakage or backflow. ISO/IEC 27001:2022 Annex A 8.20 supports this by requiring networks and network devices to be secured, managed and controlled, which underpins the secure deployment and operation of a CDS and its directional controls. Annex A 8.20 does not explicitly require independent up/down enforcement functions, so it cannot be treated as equivalent to ISM-1522.
This control supports A.8.27.
ISM-1522 requires a CDS architecture where upward and downward data paths have independent security-enforcing functions. ISO/IEC 27001:2022 Annex A 8.27 supports this by mandating secure system architecture and engineering principles, which would include principles such as separation of duties, defence-in-depth, and segregation of data flows that justify and guide independent path enforcement in a CDS. Annex A 8.27 is a high-level engineering requirement, whereas ISM-1522 is a specific cross-domain design constraint focused on directional isolation.
This control depends on A.8.22.
ISM-1522 requires CDSs to implement independent security-enforcing functions for both upward and downward data paths across network boundaries. ISO/IEC 27001:2022 Annex A 8.22 supports this by requiring network segregation, which is a foundational architectural measure that reduces unintended bidirectional flows and helps define where a CDS must enforce separate paths. However, Annex A 8.22 is broader and more general about segmentation, while ISM-1522 is a specific CDS design requirement for independent enforcement per direction.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.