Skip to content
Gateways
ASD ISMISM-1783

ASD ISM 1783 Secure BGP with valid ROA for IP addresses

What it says

Public IP addresses controlled by, or used by, an organisation are signed by valid ROA records.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure public IP addresses are protected by valid Route Origin Authorisation records to enhance security.

This control is about making sure that the routes your internet traffic takes are secure and correctly identified. Without this, there's a risk that hackers can misdirect or intercept your online communications, potentially leading to data theft or service disruptions.

Why it matters

If valid ROAs are not maintained for organisation public prefixes, BGP routes can be hijacked, redirecting traffic and causing outages or compromise.

How to implement

  1. The network administrator should identify all the public IP addresses used by the organisation.

    Make a list of these addresses so you know exactly what needs to be protected.

  2. IT teams must ensure each public IP address has a Route Origin Authorisation (ROA) record.

    Use an online ROA service or contact your internet service provider to verify if records are in place.

  3. The IT manager should create a routine check for the validity of all ROA records.

    Schedule a regular review, such as quarterly, to ensure records are still correct and up-to-date.

  4. System administrators need to configure alerts for any changes in the routing of IP addresses.

    Utilise routing monitoring tools that notify the administrators if routes deviate from the expected path.

  5. Management should establish a policy that all new IP addresses must have a ROA before deployment.

    This can be ensured by including this requirement in procurement or deployment standards.

Keep it running

Routinely validate ROAs for all public prefixes, monitor RPKI status, renew before expiry, and set maxLength to match announced prefixes and planned changes.

Evidence and audit

  1. Check 1 of 3What an auditor asks for

    Ask for

    A list of all public IP addresses: Verify that the organisation knows which IP addresses they're using.

    Look at

    Comprehensiveness and accuracy.

    Good evidence

    List includes all currently active IPs.

  2. Check 2 of 3What an auditor asks for

    Ask for

    To see the last routine check of ROA records.

    Look at

    The review schedule and results. Good practice shows updates were made if records were incorrect or missing.

    Good evidence

    System reflects no unresolved or unexplained changes.

  3. Check 3 of 3What an auditor asks for

    Ask for

    The policy documentation regarding new IP deployments: Verify it requires valid ROA records.

    Good evidence

    Policy document, dated and signed, clearly details the ROA requirement.

Mappings

Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.20Network and network devices securityPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.