ASD ISM 1800 Ensure network devices have trusted firmware
What it says
Network devices are flashed with trusted firmware before they are used for the first time.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNetwork devices must be installed with trusted firmware before their first use to prevent security risks.
Before you use network devices like routers or switches, you should make sure they have trusted software installed. This is crucial because if you use them with untrusted software, it could have hidden problems that let attackers get into your network, leading to data breaches and privacy issues.
Free. Save your status, tasks and notes.
Why it matters
Using network devices with untrusted firmware risks allowing attackers to exploit hidden vulnerabilities, leading to potential breaches and data loss.
How to implement
IT team should verify firmware integrity: Before installing any network device, ensure the IT team checks the firmware to see if it comes from a reputable source.
This can involve downloading firmware only from the official site of the manufacturer and double-checking its authenticity with verification tools.
Procurement should select reputable vendors: Ensure that the procurement team selects network devices from manufacturers known for high security standards.
This may involve researching customer reviews, checking the company's reputation in the cyber security field, and reviewing any published security reports.
IT team should set up a process for firmware updates: Establish a procedure for regularly checking and updating the firmware of all network devices.
This includes scheduling regular updates, testing updates on a non-critical device first, and keeping records of each update.
Manager should conduct training sessions: Ensure staff involved with network devices know how to handle firmware updates and the risks of using unverified software.
Conduct annual training sessions, which can include instructions on what firmware is, why it needs to be trusted, and how to verify it.
IT team should document firmware checks: Create and maintain a log for each device that records when the firmware was last checked or updated.
Include the version number, source of the firmware, and verification results.
Keep it running
Before first use, flash devices with vendor-approved firmware, then verify image integrity (hash/signature) and record firmware versions for audit.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Firmware verification documentation: Request to see records showing where each network device's firmware was sourced and verified.
Look at
The documentation for dates and verification steps listed to ensure they're from credible sources.
Good evidence
Complete records with detailed steps showing checks were performed before device use.
- Check 2 of 5What an auditor asks for
Ask for
Device vendor selection criteria: Request the criteria used by procurement to choose network device vendors.
Look at
Evidence that the criteria included security standards and vendor reputation.
Good evidence
Documented criteria highlighting vendor reputation and specific security behaviours considered in the selection.
- Check 3 of 5What an auditor asks for
Ask for
Training records of IT staff: Request to see a list of training sessions held for IT staff regarding firmware management.
Look at
Attendance lists, dates, and topics covered.
Good evidence
Training records showing regular and comprehensive training on firmware verification processes.
- Check 4 of 5What an auditor asks for
Ask for
The process document for firmware updates: Request the procedure or policy that outlines how firmware updates are managed.
Look at
Details about regular schedules, validation processes, and logging of actions.
Good evidence
A detailed, up-to-date document outlining precise steps and responsible parties.
- Check 5 of 5What an auditor asks for
Ask for
Samples of firmware update logs: Request logs of a few randomly chosen devices to review past update activities.
Look at
Entries with dates, firmware versions, and sources of updates.
Good evidence
Consistent logs indicating regular updates, with verified sources and no gaps in records.
Mappings
Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.21.
ISM-1800 requires flashing network devices with trusted firmware before first use to reduce the likelihood of supply chain or pre-compromise in device code. Annex A 5.21 requires managing information security risks associated with the ICT supply chain, including integrity and authenticity of ICT products and components obtained from suppliers. ISM-1800 is a specific supply-chain risk mitigation focused on firmware integrity at deployment, whereas Annex A 5.21 covers broader supplier, product, and service risks across the lifecycle.
This control partially meets A.8.20.
ISM-1800 requires network devices to be flashed with trusted firmware before they are used for the first time, reducing the risk of compromised or unauthorised device code. Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which can include ensuring devices run authentic, vendor-trusted firmware. ISM-1800 is a specific preventative measure within the broader network device security expectations of Annex A 8.20.
This control partially overlaps A.8.19.
ISM-1800 requires network devices to be flashed with trusted firmware before first use to prevent introduction of compromised device software. Annex A 8.19 requires secure procedures and measures for software installation on operational systems, which can include controlled installation of firmware/software images and verification of their authenticity. Annex A 8.19 is broader across operational systems and general software installation, while ISM-1800 is narrower and time-bound to initial deployment of network device firmware.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.