ISM control lookup / Topic

Guidelines for networking

78 controls · September 2026 edition

• ISM-0385 · Functional separation between servers

  Servers maintain effective functional separation from each other.

• ISM-0516 · Network documentation

  Network documentation includes high-level network diagrams showing all connections into networks and logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances.

• ISM-0518 · Network documentation

  Network documentation is developed, implemented and maintained.

• ISM-0520 · Network access controls

  Network access controls are implemented on networks to prevent the connection of unauthorised network devices and networked IT equipment.

• ISM-0529 · Using virtual local area networks

  VLANs are not used to separate network traffic between networks belonging to different security domains.

• ISM-0530 · Using virtual local area networks

  Network devices managing VLANs are administered from the most trusted security domain.

• ISM-0534 · Disabling unused physical ports on network devices

  Unused physical ports on network devices are disabled.

• ISM-0535 · Using virtual local area networks

  Network devices managing VLANs belonging to different security domains do not share VLAN trunks.

• ISM-0536 · Public wireless networks

  Public wireless networks provided for public use are segregated from all other organisation networks.

• ISM-1006 · Network management traffic

  Security measures are implemented to prevent unauthorised access to network management traffic.

• ISM-1013 · Wireless network footprint

  The effective range of wireless communications outside an organisation’s area of control is limited by implementing RF shielding on facilities in which SECRET or TOP SECRET wireless networks are used.

• ISM-1028 · Using network-based intrusion detection and prevention systems

  A NIDS or NIPS is deployed in gateways between an organisation’s networks and other networks they do not manage.

• ISM-1030 · Using network-based intrusion detection and prevention systems

  A NIDS or NIPS is located immediately inside the outermost firewall for gateways and configured to generate event logs and alerts for network traffic that contravenes any rule in a firewall ruleset.

• ISM-1178 · Network documentation

  Network documentation provided to a third party, or published in public tender documentation, only contains details necessary for other parties to undertake contractual services.

• ISM-1181 · Network segmentation and segregation

  Networks are segregated into multiple network zones according to the criticality of servers, services and data.

• ISM-1182 · Network access controls

  Network access controls are implemented to limit the flow of network traffic within and between network segments to only that required for business purposes.

• ISM-1186 · Using Internet Protocol version 6

  IPv6 capable network security appliances are used on IPv6 and dual-stack networks.

• ISM-1304 · Network device hardening

  Default user accounts or credentials for network devices, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.

• ISM-1311 · Using the Simple Network Management Protocol

  SNMP version 1 and SNMP version 2 are not used on networks.

• ISM-1312 · Using the Simple Network Management Protocol

  All default SNMP community strings on network devices are changed and write access is disabled.

• ISM-1314 · Choosing wireless devices

  All wireless devices are Wi-Fi Alliance certified.

• ISM-1315 · Administrative interfaces for wireless access points

  The administrative interface on wireless access points is disabled for wireless network connections.

• ISM-1316 · Default settings

  Default SSIDs of wireless access points are changed.

• ISM-1317 · Default settings

  SSIDs of non-public wireless networks are not readily associated with an organisation, the location of their premises or the functionality of wireless networks.

• ISM-1318 · Default settings

  SSID broadcasting is not disabled on wireless access points.

• ISM-1319 · Static addressing

  Static addressing is not used for assigning IP addresses on wireless networks.

• ISM-1320 · Media Access Control address filtering

  MAC address filtering is not used to restrict which devices can connect to wireless networks.

• ISM-1321 · 802.1X authentication and key exchange

  802.1X with EAP-TLS is used for mutual authentication and key exchange; with all other EAP methods disabled on supplicants and authentication servers.

• ISM-1322 · Evaluation of 802.1X implementations

  Evaluated supplicants, authenticators and authentication servers are used for 802.1X authentication implementations.

• ISM-1323 · Generating and issuing X.509 certificates for authentication

  X.509 certificates are required for devices and human users authenticating to networks using 802.1X.

• ISM-1324 · Generating and issuing X.509 certificates for authentication

  X.509 certificates are generated using an evaluated certificate authority or hardware security module.

• ISM-1327 · Generating and issuing X.509 certificates for authentication

  X.509 certificates are protected by logical and physical access controls and encryption, with those issued to human users requiring authentication before use.

• ISM-1330 · Caching 802.1X authentication outcomes

  The PMK caching period is not set to greater than 1440 minutes (24 hours).

• ISM-1332 · Confidentiality and integrity of wireless network traffic

  WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrity of all wireless network traffic.

• ISM-1334 · Interference between wireless networks

  Wireless networks implement sufficient frequency separation from other wireless networks.

• ISM-1335 · Protecting management frames on wireless networks

  Wireless access points enable the use of the 802.11w amendment to protect management frames.

• ISM-1338 · Wireless network footprint

  Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power are deployed to achieve the desired footprint for wireless networks.

• ISM-1364 · Using virtual local area networks

  Network devices managing VLANs terminate VLANs belonging to different security domains on separate physical network interfaces.

• ISM-1428 · Using Internet Protocol version 6

  Unless explicitly required, IPv6 tunnelling is disabled on all network devices.

• ISM-1429 · Using Internet Protocol version 6

  IPv6 tunnelling is blocked by network security appliances at externally connected network boundaries.

• ISM-1430 · Using Internet Protocol version 6

  Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protocol version 6 in a stateful manner with lease data stored in a centralised event logging facility.

• ISM-1431 · Denial-of-service attack mitigation strategies

  Denial-of-service attack mitigation strategies are discussed with cloud service providers, specifically:

• ISM-1432 · Denial-of-service attack mitigation strategies

  Domain names for online services are protected via registrar locking and confirming that domain registration details are correct.

• ISM-1436 · Denial-of-service attack mitigation strategies

  Critical online services are segregated from other online services that are more likely to be targeted as part of denial-of-service attacks.

• ISM-1437 · Cloud-based hosting of online services

  Cloud service providers are used for hosting online services.

• ISM-1438 · Using content delivery networks

  Where a high availability requirement exists for website hosting, CDNs that cache websites are used.

• ISM-1439 · Using content delivery networks

  If using CDNs, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the CDNs and authorised management networks.

• ISM-1454 · Remote Authentication Dial-In User Service authentication

  Communications between authenticators and a RADIUS server are encapsulated with an additional layer of encryption using RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security.

• ISM-1479 · Functional separation between servers

  Servers minimise communications with other servers at the network and file system level.

• ISM-1532 · Using virtual local area networks

  VLANs are not used to separate network traffic between an organisation’s networks and public network infrastructure.

• ISM-1577 · Network segmentation and segregation

  An organisation’s networks are segregated from their service providers’ networks.

• ISM-1579 · Capacity and availability planning and monitoring for online services

  Cloud service providers’ ability to scale resources dynamically in response to genuine spikes in demand is discussed and verified as part of capacity and availability planning for online services.

• ISM-1580 · Capacity and availability planning and monitoring for online services

  Where a high availability requirement exists for online services, the services are architected to automatically transition between availability zones.

• ISM-1581 · Capacity and availability planning and monitoring for online services

  Continuous real-time monitoring of the capacity and availability of online services is performed.

• ISM-1627 · Blocking anonymity network traffic

  Inbound network connections from anonymity networks are blocked.

• ISM-1628 · Blocking anonymity network traffic

  Outbound network connections to anonymity networks are blocked.

• ISM-1710 · Default settings

  Settings for wireless access points are hardened.

• ISM-1711 · 802.1X authentication and key exchange

  User identity confidentiality is used if available with EAP-TLS implementations.

• ISM-1712 · Fast Basic Service Set Transition

  The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications are secured by an ASD-Approved Cryptographic Protocol.

• ISM-1781 · Network encryption

  All data communicated over network infrastructure is encrypted using ASD-approved cryptography.

• ISM-1782 · Protective Domain Name System Services

  A protective DNS service is used to block access to known malicious domain names.

• ISM-1800 · Network device integrity

  Network devices are flashed with trusted firmware before they are used for the first time.

• ISM-1801 · Regularly restarting network devices

  Network devices are restarted at least monthly.

• ISM-1863 · Networked management interfaces

  Networked management interfaces for IT equipment are not directly exposed to the internet.

• ISM-1912 · Network documentation

  Network documentation includes device settings for all critical servers, high-value servers, network devices and network security appliances.

• ISM-1962 · Using the Server Message Block protocol

  SMB version 1 is not used on networks.

• ISM-1963 · Network device event logging

  Security-relevant events for internet-facing network devices are centrally logged.

• ISM-1964 · Network device event logging

  Security-relevant events for non-internet-facing network devices are centrally logged.

• ISM-2017 · Encrypted Domain Name System Services

  DNS traffic is encrypted by clients and servers using ASD-approved cryptography.

• ISM-2068 · Functional separation between networked devices and the internet

  Internet connectivity for networked devices is strictly limited to those that require access.

• ISM-2160 · Networked management interfaces

  Networked management interfaces for IT equipment are only accessible from a dedicated management network that is segregated from the wider network and the internet.

• ISM-2161 · Network device integrity

  The integrity of network device firmware and running configurations is verified against an approved known-good baseline following patching, on detection of anomalous behaviour and at least monthly.

• ISM-2162 · Network device hardening

  Unneeded components, services and functionality of network devices are disabled or removed.

• ISM-2163 · Media Access Control Security

  When using MACsec, confidentiality protection mode is enabled using GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 or GCM-AES-XPN-256, preferably GCM-AES-256 or GCM-AES-XPN-256.

• ISM-2164 · Media Access Control Security

  A connectivity association lifetime of less than 24 hours (86400 seconds) is used for MACsec connections.

• ISM-2165 · Media Access Control Security

  When using EAP-TLS, each device performs a fresh EAP-TLS authentication each time a new Connectivity Association Key is required.

• ISM-2166 · Media Access Control Security

  A secure association lifetime of less than four hours (14400 seconds) is used for MACsec connections.

• ISM-2167 · Media Access Control Security

  The use of a Pre-Shared Key as a fallback authentication method for MACsec is disabled.