ASD ISM 2068 Restrict internet access for networked devices
What it says
Internet connectivity for networked devices is strictly limited to those that require access.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLimit internet connection only to devices that need it to ensure security.
This control is about limiting internet access only to the devices that really need it. It matters because if devices that shouldn't be online are connected to the internet, they could be hacked, spreading viruses or leaking sensitive data which could harm your business.
Free. Save your status, tasks and notes.
Why it matters
Unnecessary internet-connected devices increase the attack surface, enabling compromise, malware spread and potential data exfiltration.
How to implement
Managers should identify which devices actually need internet access for essential business functions.
Create a list by discussing with team members how each device is used and which tasks require internet connectivity.
The IT team should configure network settings to restrict internet access for devices that aren't on the list.
Use a router or firewall to allow internet access only to approved devices and block others.
System owners should regularly review and update the list of devices needing internet access.
This can be done by sending a monthly reminder to team leaders to check the current needs and report back.
IT team must set up alerts for any unauthorised device attempting to access the internet.
Use basic network monitoring tools that notify administrators if a new device connects.
Managers should hold a training session for staff to understand the risks of improper internet access.
Use clear examples of potential threats and discuss how restricting access helps protect the business.
Keep it running
Regularly audit and enforce which devices have internet egress, removing access where not required and documenting approved exceptions.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The current list of devices permitted internet access. Check the list includes only operationally necessary devices and is signed off by a manager.
Good evidence
List will be dated, with device details and manager approval.
- Check 2 of 4What an auditor asks for
Look at
Timestamps and identify any unexpected devices attempting or succeeding to connect.
Good evidence
Log will show only authorised device access or attempts.
- Check 3 of 4What an auditor asks for
Ask for
The network configuration settings. Check that the settings enforce the access restrictions described. Good settings will reflect exactly the list of approved devices.
Look at
Details on any unauthorised device incidents and responses.
Good evidence
Report will show prompt recognition and handling of alerts.
- Check 4 of 4What an auditor asks for
Ask for
Training session attendance records. Check that recent sessions covered internet access risks and how they are managed.
Good evidence
Attendance record will show wide participation across relevant staff.
Mappings
Closest match in ISO/IEC 27001: A.8.23, Web filtering to reduce malicious website exposure, which partially overlaps with this control.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.8.23.
ISM-2068 requires organisations to strictly limit internet connectivity to only those networked devices that require access. Annex A 8.23 relates by managing access to external websites through web filtering to reduce exposure to malicious content, controlling internet use once connectivity exists.
This control depends on A.8.21.
ISM-2068 requires organisations to strictly limit internet connectivity to only those networked devices that require access. Annex A 8.21 supports this by requiring security mechanisms and service requirements for network services to be identified, implemented and monitored, which can include enforcing and monitoring internet egress controls.
This control depends on A.8.22.
ISM-2068 requires organisations to strictly limit internet connectivity to only those networked devices that require access. Annex A 8.22 supports this by requiring segregation of groups of information services, users and systems, which enables isolating non-internet-requiring devices onto networks without outbound internet paths. The ISO control provides broader network architecture guidance, while ISM-2068 is focused on restricting internet access.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-RA-ML1.4.
E8-RA-ML1.4 requires that privileged accounts authorised to use online services are limited to only the access required for their duties. ISM-2068 overlaps by limiting which networked devices are allowed internet connectivity, which can indirectly constrain where privileged accounts can access online services from and reduce unnecessary pathways. The primary is identity/authorisation focused for privileged accounts, while ISM-2068 is device/network connectivity scoping irrespective of account privilege.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.