Skip to content
Networking
ASD ISMISM-1863

ASD ISM 1863 Restrict exposure of network management interfaces

What it says

Networked management interfaces for IT equipment are not directly exposed to the internet.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

IT equipment management interfaces should not be accessible from the internet to enhance security.

This control is about keeping the parts of your office technology that let you manage and control those systems away from the public internet. Think of it like keeping the keys to your store locked up. If these management tools are available online, someone could break in and control your systems, steal information, or disrupt your operations.

Why it matters

Exposing management interfaces to the internet enables unauthorised admin access, leading to compromise, data loss, and disruption.

How to implement

  1. The IT team should ensure that management interfaces are only accessible from within the company network.

    They can set this up by configuring firewall rules to block internet access to these interfaces.

  2. System administrators should implement network segmentation to separate management interfaces from the standard user network.

    This can be done by creating a dedicated management network and ensuring that only authorised personnel have access.

  3. IT security staff should set up a Virtual Private Network (VPN) for remote access to management interfaces.

    This involves configuring a secure tunnel that encrypts data, providing access only after verifying the user's identity.

  4. Network managers should regularly review and update access control lists.

    This includes checking who has access to management interfaces and ensuring that only necessary personnel are allowed.

  5. The security officer should conduct regular training sessions for staff who require access to management interfaces.

    They can educate staff on best practices and the importance of not exposing these systems to the internet.

Keep it running

Ensure management interfaces are not internet-exposed; provide admin access only via VPN/bastion and restrict by allowlisted subnets.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The network diagram that shows the management interfaces of IT equipment.

    Look at

    Evidence that these interfaces are isolated from the internet.

    Good evidence

    Is a diagram that clearly indicates segmentation and controlled access points.

  2. Check 2 of 5What an auditor asks for

    Look at

    The rules blocking external internet access to these interfaces.

    Good evidence

    Outcome is seeing rules that completely prevent outside access.

  3. Check 3 of 5What an auditor asks for

    Ask for

    To see VPN configuration documents for remote access to management interfaces.

    Look at

    Encryption settings and user access policies.

    Good evidence

    Result is having robust encryption and clear access policies that restrict users.

  4. Check 4 of 5What an auditor asks for

    Good evidence

    Has only essential staff on the list with documentation of managerial approval.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Training records regarding the secure use of management interfaces.

    Look at

    Regular sessions that cover recent security threats and policies.

    Good evidence

    Record shows consistent training aligned with current risks.

Mappings

Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.20Network and network devices securityPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.