ISM control lookup / Topic

Guidelines for gateways

63 controls · September 2026 edition

• ISM-0100 · Assessment of gateways

  Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.

• ISM-0260 · Using web proxies

  All web access, including that by internal servers, is conducted through web proxies.

• ISM-0261 · Web proxy event logging

  The following details are centrally logged for websites accessed via web proxies:

• ISM-0263 · Transport Layer Security filtering

  TLS traffic communicated through gateways is decrypted and inspected.

• ISM-0591 · Using peripheral switches

  Evaluated peripheral switches are used when sharing peripherals between systems.

• ISM-0597 · Consultation on cross domain solutions

  When planning, designing, implementing or introducing additional connectivity to CDSs, ASD is consulted and any directions provided by ASD are complied with.

• ISM-0610 · Cross domain solution use

  Human users are trained on the secure use of CDSs before access is granted.

• ISM-0611 · System administrators for gateways

  System administrators for gateways are assigned the minimum privileges required to perform their duties.

• ISM-0612 · System administrators for gateways

  System administrators for gateways are formally trained on the operation and management of gateways.

• ISM-0613 · System administrators for gateways

  System administrators for gateways that connect to Australian Eyes Only or Releasable To networks are Australian nationals.

• ISM-0616 · System administrators for gateways

  Separation of duties is implemented in performing administrative activities for gateways.

• ISM-0619 · Authenticating to networks accessed via gateways

  Users authenticate to other networks accessed via gateways.

• ISM-0622 · Authenticating to networks accessed via gateways

  IT equipment authenticates to other networks accessed via gateways.

• ISM-0626 · Implementing cross domain solutions

  CDSs are implemented between SECRET or TOP SECRET networks and any other networks belonging to different security domains.

• ISM-0628 · Implementing gateways

  Gateways are implemented between networks belonging to different security domains.

• ISM-0629 · System administration of gateways

  For gateways between networks belonging to different security domains, any shared components are managed by system administrators for the higher security domain or by system administrators from a mutually agreed upon third party.

• ISM-0631 · Implementing gateways

  Gateways only allow explicitly authorised data flows.

• ISM-0634 · Gateway event logging

  Security-relevant events for gateways are centrally logged, including:

• ISM-0635 · Separation of data flows

  CDSs implement isolated upward and downward network paths.

• ISM-0637 · Implementing gateways

  Gateways implement a demilitarised zone if external parties require access to an organisation’s services.

• ISM-0639 · Using firewalls

  Evaluated firewalls are used between networks belonging to different security domains.

• ISM-0643 · Using diodes

  Evaluated diodes are used for controlling the data flow of unidirectional gateways between an organisation’s networks and public network infrastructure.

• ISM-0645 · Using diodes

  Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and public network infrastructure complete a high assurance evaluation.

• ISM-0649 · Allowing specific content types

  Files imported or exported via gateways or CDSs are filtered for allowed file types.

• ISM-0651 · Performing content filtering

  Files identified by content filtering checks as malicious, or that cannot be inspected, are blocked.

• ISM-0652 · Performing content filtering

  Files identified by content filtering checks as suspicious are quarantined until reviewed and subsequently approved or not approved for release.

• ISM-0659 · Performing content filtering

  Files imported or exported via gateways or CDSs undergo content filtering checks.

• ISM-0670 · Cross domain solution event logging

  Security-relevant events for CDSs are centrally logged.

• ISM-0677 · Validating file integrity

  Files imported or exported via gateways or CDSs that have a digital signature or cryptographic checksum are validated.

• ISM-0958 · Allowing and blocking access to domain names

  An organisation-approved list of domain names, or list of website categories, is implemented for all Hypertext Transfer Protocol and Hypertext Transfer Protocol Secure traffic communicated through gateways.

• ISM-0961 · Using web content filters

  Client-side active content is restricted by web content filters to an organisation-approved list of domain names.

• ISM-0963 · Using web content filters

  Web content filtering is implemented to filter potentially harmful web-based content.

• ISM-1037 · Assessment of gateways

  Gateways undergo testing following configuration changes, and at regular intervals no more than six months apart, to validate that they conform to expected security configurations.

• ISM-1157 · Using diodes

  Evaluated diodes are used for controlling the data flow of unidirectional gateways between networks.

• ISM-1158 · Using diodes

  Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and any other networks complete a high assurance evaluation.

• ISM-1171 · Allowing and blocking access to domain names

  Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.

• ISM-1192 · Implementing gateways

  Gateways inspect and filter data flows at the transport and above network layers.

• ISM-1236 · Allowing and blocking access to domain names

  Malicious domain names, dynamic domain names and domain names that can be registered anonymously for free are blocked by web content filters.

• ISM-1237 · Using web content filters

  Web content filtering is applied to outbound web traffic where appropriate.

• ISM-1284 · Content validation

  Files imported or exported via gateways or CDSs undergo content validation.

• ISM-1286 · Content conversion

  Files imported or exported via gateways or CDSs undergo content conversion.

• ISM-1287 · Content sanitisation

  Files imported or exported via gateways or CDSs undergo content sanitisation.

• ISM-1288 · Antivirus scanning

  Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines.

• ISM-1289 · Archive files

  Archive files imported or exported via gateways or CDSs are unpacked to undergo content filtering checks.

• ISM-1290 · Archive files

  Archive files are unpacked in a controlled manner to ensure content filter performance or availability is not adversely affected.

• ISM-1293 · Encrypted files

  Encrypted files imported or exported via gateways or CDSs are decrypted to undergo content filtering checks.

• ISM-1389 · Automated dynamic analysis

  Executable files imported via gateways or CDSs are automatically executed in a sandbox to detect any suspicious behaviour.

• ISM-1427 · Implementing gateways

  Gateways perform ingress traffic filtering to detect and prevent IP source address spoofing.

• ISM-1457 · Using peripheral switches

  Evaluated peripheral switches used for sharing peripherals between SECRET and TOP SECRET systems, or between SECRET or TOP SECRET systems belonging to different security domains, preferably complete a high assurance evaluation.

• ISM-1480 · Using peripheral switches

  Evaluated peripheral switches used for sharing peripherals between SECRET or TOP SECRET systems and any non-SECRET or TOP SECRET systems complete a high assurance evaluation.

• ISM-1520 · System administrators for gateways

  System administrators for gateways undergo appropriate employment screening, and where necessary hold an appropriate security clearance, based on the sensitivity or classification of gateways.

• ISM-1521 · Separation of data flows

  CDSs implement protocol breaks at each network layer.

• ISM-1522 · Separation of data flows

  CDSs implement independent security-enforcing functions for upward and downward network paths.

• ISM-1523 · Cross domain solution event logging

  A sample of security-relevant events relating to data transfer policies are taken at least every three months and assessed against security policies for CDSs to identify any operational failures.

• ISM-1524 · Performing content filtering

  Content filters used by CDSs undergo rigorous security testing to ensure they perform as expected and cannot be bypassed.

• ISM-1528 · Using firewalls

  Evaluated firewalls are used between an organisation’s networks and public network infrastructure.

• ISM-1773 · System administrators for gateways

  System administrators for gateways that connect to Australian Government Access Only networks are Australian nationals or seconded foreign nationals.

• ISM-1774 · System administration of gateways

  Gateways are managed via a secure path isolated from all connected networks.

• ISM-1783 · Border Gateway Protocol routing security

  Public IP addresses controlled by, or used by, an organisation are signed by valid ROA records.

• ISM-1862 · Using web application firewalls

  If using a WAF, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks.

• ISM-1965 · Content checking

  Files imported or exported via gateways or CDSs undergo content checking.

• ISM-2018 · Border Gateway Protocol routing security

  Routes for RPKI-registered IP addresses that are advertised from invalid Autonomous Systems, or that are longer than allowed, are rejected or deprioritised by routers that exchange routes via BGP.

• ISM-2019 · Assessment of gateways

  TOP SECRET gateways undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the assessment (or a subsequent release), at least every 24 months.