ASD ISM 1774 Secure management paths for network gateways
What it says
Gateways are managed via a secure path isolated from all connected networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGateways are managed separately from any networks they are connected to ensure security.
This control is about keeping network gateways, which help manage internet traffic in and out of your business, secure by ensuring they are maintained separately from the rest of your computer network. If this isn't done, a malicious attack on your network could easily spread to your gateways, causing potential data breaches or system downtime.
Free. Save your status, tasks and notes.
Why it matters
Without an isolated secure management path, attackers from connected networks can access gateway admin interfaces, leading to compromise and outages.
How to implement
IT team should set up a separate management network for gateways.
This involves creating a dedicated network space that is not used for any other tasks except managing gateways, ensuring they aren't accessed from the main business network.
System owner should ensure all gateway management is conducted from secure and authorised devices only.
This means using computers that are specially approved and equipped with up-to-date security measures to access the gateways.
Manager should establish clear policies on who can access the secure management paths.
Document a list of personnel authorised to manage the gateways and ensure this list is kept up-to-date and reviewed regularly.
IT team should regularly test the security of the management paths.
Conduct security audits by simulating common attack scenarios to ensure that the management paths are adequately protected and cannot be easily breached.
The procurement team should choose gateway management tools that support isolation.
This means selecting software solutions that have built-in features for separating management functions from main network activities.
Keep it running
Regularly confirm gateway management is isolated (OOB/VLAN), restrict admin access, and block management ports from all connected networks.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Network diagrams showing the separation of management paths: Request updated diagrams that outline how management paths are kept separate from the main network.
Look at
The pathways and ensure they do not intersect with the business network.
Good evidence
Clear, highlighted paths showing physical or virtual separation.
- Check 2 of 5What an auditor asks for
Ask for
Access logs to the secure management paths: Request logs of who accessed the management paths and when.
Look at
Authorised access and any anomalies in the access patterns. Good is consistent, authorised access with no unauthorised or an unexplained entry.
- Check 3 of 5What an auditor asks for
Ask for
The list of authorised personnel: Request the documented list of people allowed to manage the gateways.
Look at
The date and signatories of its latest update. Good is a recent, formally reviewed list with clear roles and responsibilities.
- Check 4 of 5What an auditor asks for
Ask for
The security audit reports of management paths: Request the most recent reports from security assessments of the gateways.
Look at
The findings and remediation actions taken. Good is a report showing risks identified and confirmed remediation measures in place.
- Check 5 of 5What an auditor asks for
Ask for
Documentation of gateway management tools selection: Request records of the criteria used for selecting gateway management tools.
Look at
How isolation features were considered during the decision-making process.
Good evidence
Documented criteria with clear emphasis on secure management requirements.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-1774 requires gateways to be managed via a secure management path that is isolated from all connected networks. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled to protect information, which includes securely administering network devices such as gateways. ISM-1774 is a specific prescriptive administrative-network isolation requirement, whereas Annex A 8.20 is broader and can be satisfied through multiple complementary network/device security measures.
This control partially overlaps A.8.22.
ISM-1774 requires gateways to be managed over a secure path isolated from networks the gateway connects to (i.e., separation of the management plane from data/connected networks). ISO/IEC 27001:2022 Annex A 8.22 requires segregation of groups of information services, users and systems within organisational networks, which can include segregating a dedicated management network/VLAN. Annex A 8.22 is broader network segmentation, while ISM-1774 is specifically about secure, isolated management access to gateways.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.