ASD ISM 2112 Disable AI applications' direct access to external public data sources
What it says
AI applications that process classified data have their ability to directly access external public data sources disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAI applications that handle classified (sensitive) information must not be able to reach out to external public data sources on their own.
Some AI (artificial intelligence) applications can connect to the public internet to look things up or pull in outside information. When an AI application works with classified data (highly sensitive or restricted information), that direct connection to external public data sources must be switched off. This stops the AI from accidentally sending protected information out to the wider internet, and stops it pulling in untrusted outside content that could mislead it or expose your organisation.
Free. Save your status, tasks and notes.
Why it matters
If an AI application handling classified data can reach the public internet directly, it may leak sensitive information outside the organisation or ingest untrusted content, causing a serious data breach.
How to implement
The system owner should first identify which AI applications in the organisation process classified or sensitive data, and record each one in a simple register so it is clear which applications this control applies to.
The IT team should turn off any built-in feature that lets these AI applications fetch information directly from the public internet, for example web browsing, live web search, or external plug-ins and connectors, by changing the application's configuration or admin settings.
The IT administrator should use network controls such as firewall rules or an allow-list to block the AI application's servers from reaching external public addresses, so the restriction holds even if an application setting is changed by mistake.
Where the AI application genuinely needs outside information, the IT team should route that data through an approved, controlled intermediary (for example a vetted internal data store or a reviewed feed) rather than letting the AI connect to public sources itself.
The system owner should document the configuration in a short procedure and re-check the settings after every application update or upgrade, because vendor updates can quietly switch external access back on.
Keep it running
Re-verify these settings after every application or vendor update, since upgrades often re-enable external access by default and can silently undo the control.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the list of AI applications that process classified data.
Look at
whether each one is named with its data classification and owner.
Good evidence
is a current register that clearly maps each AI application to the sensitive data it handles.
- Check 2 of 5What an auditor asks for
Ask for
to see the configuration settings for each of those AI applications.
Look at
whether web browsing, live search, external plug-ins and connectors are turned off.
Good evidence
is a screenshot or exported config showing external public data access is explicitly disabled.
- Check 3 of 5What an auditor asks for
Ask for
the network or firewall rules that block these AI applications from reaching the public internet.
Look at
whether the rules actually deny outbound external connections for the relevant systems.
Good evidence
is rule sets plus a test result showing the connection is blocked.
- Check 4 of 5What an auditor asks for
Ask for
how outside information reaches the AI application when it is genuinely needed.
Look at
whether it flows through an approved, controlled intermediary rather than a direct public link.
Good evidence
describes a vetted internal feed or store with named approvers.
- Check 5 of 5What an auditor asks for
Ask for
evidence the settings are re-checked after updates.
Look at
change records or a checklist showing the control was verified following recent application upgrades.
Good evidence
shows dated re-verification tied to specific update events.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-2112 requires a specific logical access restriction: AI applications processing classified data must not directly access external public data sources. ISO/IEC 27001:2022 Annex A 5.15 relates by requiring access control policies and procedures that can define and mandate such outbound access prohibitions for systems and services. Annex A 5.15 is broader and policy-oriented, while ISM-2112 is a concrete, technology-enforceable restriction scoped to AI and classified data.
This control partially overlaps A.8.23.
ISM-2112 requires disabling AI applications' direct access to external public data sources when processing classified data. ISO/IEC 27001:2022 Annex A 8.23 overlaps because web filtering and managed access to external websites can be used to restrict or block AI systems from reaching public internet sources. Annex A 8.23 focuses on reducing exposure to malicious content, whereas ISM-2112 is primarily about preventing classified data exposure via outbound access irrespective of maliciousness.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.