ASD ISM 1577 Ensure network segregation from service providers
What it says
An organisation's networks are segregated from their service providers' networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that an organisation's network is kept separate from its service providers' networks for better security.
This control is about making sure your organisation's network, the system your computers and data use to communicate, is kept separate from the networks of any external service providers you work with. This matters because if your networks are mixed, a security issue or attack on the service provider could spill over and affect your business, putting your data and operations at risk.
Free. Save your status, tasks and notes.
Why it matters
A breach in a service provider's network could pivot into yours, causing unauthorised access, data theft, or outages if links aren't segregated.
How to implement
The IT team should create separate network segments for your organisation and your service providers.
They can do this by setting up different virtual networks and using firewalls to control the flow of information between them.
Managers should ensure that any service agreements with providers include clauses about network segregation.
This means when you're negotiating contracts, check that there is a clear statement that your networks will remain separate.
System owners should run tests to confirm network segregation is working.
This means they should periodically try to send simple data between the networks to ensure it doesn't get through unless it's supposed to.
Procurement staff should check that any new service providers can meet the requirement of network segregation.
They can do this by asking potential providers how they plan to keep the networks separate and by checking if they have had security audits.
HR should provide training sessions for employees on why network segregation from service providers is important.
This could include workshops or online training to help staff understand how segregation works and why it protects the organisation.
Keep it running
Review and test segregation of provider connections (VLAN/VRF/ACLs, VPNs, routing, and firewall rules) and remediate any drift detected.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The network architecture document: Request a diagram showing the organisation's and service providers' network setup.
Look at
How the networks are logically separated.
Good evidence
Includes clear demarcations with labelled segments or firewalls separating different networks.
- Check 2 of 5What an auditor asks for
Ask for
The service agreement documentation: Request the contracts or agreements with service providers.
Look at
Clauses on network segregation and security measures.
Good evidence
Includes specific provisions ensuring network separation.
- Check 3 of 5What an auditor asks for
Ask for
The latest network security test reports: Request the results of any security tests or audits that have been conducted.
Look at
The findings related to network segregation.
Good evidence
Shows no major issues reported regarding network mixing.
- Check 4 of 5What an auditor asks for
Ask for
Firewall configuration settings: Request access to documentation on current firewall setups.
Look at
How rules are structured to prevent unsolicited traffic between the organisation's and providers' networks.
Good evidence
Shows rules that block unnecessary data flow between different networks.
- Check 5 of 5What an auditor asks for
Ask for
Employee training records: Request logs of recent training sessions related to network security.
Look at
Attendance and completion rates.
Good evidence
Shows regular training sessions with high participation from relevant staff.
Mappings
Closest match in ISO/IEC 27001: A.8.21, Security of network services, which partially overlaps with this control.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.8.21.
Annex A 8.21 requires an organisation to identify, implement and monitor security mechanisms and service requirements for network services. ISM-1577 relates by mandating segregation between an organisation's networks and service providers' networks, which is a concrete security mechanism for certain network services (e.g. outsourced connectivity, managed network services). ISM-1577 is narrower (focused on provider segregation) while Annex A 8.21 also covers broader network service requirements such as agreed service levels, monitoring and end-to-end security expectations across all network services.
This control partially overlaps A.8.22.
Annex A 8.22 requires segregation of groups of services, users, and systems within organisational networks. ISM-1577 directly relates by mandating segregation between an organisation's networks and service providers' networks, focusing on external boundary segmentation.
This control depends on A.5.19.
ISM-1577 requires an organisation's networks to be segregated from their service providers' networks as a concrete technical risk treatment for third-party connectivity. ISO/IEC 27001:2022 Annex A 5.19 requires processes to manage information security risks in supplier relationships, under which network segregation is a common control expectation for connected suppliers. Annex A 5.19 is governance and lifecycle focused, while ISM-1577 is a specific technical architecture outcome for supplier network separation.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-18.1Isolate systems in criticality- and trust-based network zones with approved, monitored pathwaysPartially overlaps
This control partially overlaps IT.PRO-18.1.
IT.PRO-18.1 requires systems to be isolated in network zones by criticality and trust level; ISM-1577 requires an organisation's networks to be segregated from its service providers' networks, applying that trust-based separation at the service provider boundary.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.